A 16-year-old bug hunter found Microsoft's internal Titan analytics API and discovered that it validated the JWT tenant, audience, app ID and user, but apparently forgot the slightly important part: validating the signature.
His AI agent spent 10 days grinding through the authentication errors. Eventually he tried admin as the username, Titan resolved it to a local admin account, and he ended up with SQL access to an environment containing an estimated 17.3 trillion stored rows across 17 analytics databases.
Microsoft fixed it and paid him a $5,000 bounty.
Some bugs are just beautiful in their simplicity.
submitted by /u/Haunting_Ganache_850[link] [comments]