16-Year-Old Researcher Bypasses Microsoft Titan Authentication Mechanisms

A 16-year-old security researcher known as Faav discovered a vulnerability in the authentication mechanism of Microsoft's internal Titan analytics service, allowing him to bypass identity verification and execute SQL queries via the /v2/Query path. He reported the issue to MSRC on September 5, 2026; Microsoft closed the affected endpoint on September 9 and paid him a $5,000 bounty. Reports indicated potential exposure of about 17.3 trillion rows across ClickHouse databases, but these were historical and duplicate records, with no customer PII accessed and no signs of malicious exploitation.