Microsoft Power Apps Vulnerability Exposes 38 Million Records

Key Takeaways

• A 16-year-old researcher, Faav, identified a critical authentication bypass in Microsoft’s internal Titan analytics service.
• The flaw could have allowed unauthorized SQL queries and access to an estimated 17.3 trillion database rows, though no customer PII was accessed.
• The vulnerability stemmed from insufficient cryptographic validation of JSON Web Tokens (JWTs), allowing forged administrator access.
• Microsoft promptly patched the vulnerability within days of responsible disclosure and awarded a bounty.

Microsoft’s Titan Analytics Service Exposed by Authentication Bypass

A significant authentication bypass vulnerability has been discovered within Microsoft’s proprietary Titan analytics service, potentially exposing an astounding 17.3 trillion database rows. The flaw, identified by a 16-year-old security researcher known as Faav, centered on an ability to forge administrator access and execute unauthorized SQL queries without requiring valid Microsoft credentials.

Faav emphasized that while the potential scale of exposure was immense, the impact remained hypothetical. The researcher strictly utilized metadata, table descriptions, and limited data samples during the investigation, never accessing customer personally identifiable information (PII). Crucially, no evidence suggested that malicious actors had previously exploited this weakness.

The discovery process began on August 25, 2026, when Faav’s AI-powered hacking assistant, Antares, pinpointed Titan. Despite the service’s web interface displaying a “VPN REQUIRED” message, Antares successfully identified a public API hosted through Azure Cloud Services.

Further investigation revealed an exposed Swagger document enumerating four API routes, including a /v2/Query endpoint capable of accepting raw SQL commands. Archived Titan pages from 2023 also provided 56 table definitions and a routing value named TestData, furnishing Faav with sufficient initial data for controlled testing.

Initial requests lacking an authorization header correctly returned an HTTP 401 status. However, over the subsequent ten days, Antares meticulously manipulated JSON Web Token (JWT) claims and analyzed Titan’s error messages to understand its authentication mechanisms.

Deep Dive into the Titan Authentication Flaw

The core of the vulnerability lay in Titan’s incomplete validation of JWTs. The service checked various claims such as tenant ID, audience, application ID, and user identity, but critically, it continued processing modified claims even when the original signature of the JWT remained unaltered. This behavior indicated a fundamental security oversight: Titan evaluated the assertions within the JWT without cryptographically verifying the issuer’s authenticity.

Leveraging this flaw, Faav crafted a synthetic token by setting its algorithm to “none” and providing an empty signature. Astonishingly, Titan accepted this unsigned token. The next step involved providing a recognized user within the token’s payload. Initial automated attempts using email-formatted User Principal Names (UPNs) were unsuccessful.

The breakthrough occurred when Faav re-evaluated how the backend might interpret the upn field, ultimately replacing it with the value “admin.” This change caused Titan to map the value to local user ID 1, assign an “Admin” role, and successfully execute a basic SELECT 1 query, confirming administrative access.

Limited exploration via this bypass exposed Titan’s platform metadata database and other interconnected analytics environments. The accessible metadata reportedly included approximately 25,000 account and email records, 17,990 employee email entries, 15,001 employee organization records, 355 database configurations, 20,979 virtual-dataset SQL definitions, 24,569 dashboards, 425,891 charts, and 27,347 dataset definitions.

Furthermore, two restricted one-row queries confirmed that Bing search analytics data was also reachable. Faav confirmed that no specific individuals were identified, and no records were cross-linked between different datasets during the investigation.

To quantify the potential exposure, the researcher tested all 56 archived routing values using a SELECT 1 query; 30 of these routes remained active. These routes resolved through 24 configurations to 17 distinct ClickHouse analytics databases, encompassing 9,863 unique table names. Row totals, calculated using both system.tables.total_rows and active system.parts, produced the staggering estimate of 17,333,335,124,315 rows.

Faav cautioned that this storage figure likely includes historical, duplicated, and derived records, meaning it should not be interpreted as 17.3 trillion unique individuals or directly exposed customer records.

Faav reported the vulnerability to the Microsoft Security Response Center (MSRC) on September 5, initiating case 144051. Microsoft acted swiftly, locking down the vulnerable API endpoint on September 9. The company awarded Faav a $5,000 bounty on September 17 and coordinated the public disclosure. Microsoft publicly thanked Faav for the responsible disclosure, acknowledging that the report significantly helped harden its services and enhance customer protection.

This incident serves as a critical reminder of why claim validation alone is insufficient for securing JWT-based authentication. Applications must rigorously cryptographically verify every token signature, explicitly reject unsigned tokens, strictly limit approved algorithms, validate issuer and audience values, and avoid directly mapping attacker-controlled claims to privileged local accounts. In the case of Titan, a single missing signature check effectively bypassed multiple layers of otherwise functional access controls, transforming a public analytics endpoint into a potential gateway to an enormous Microsoft data environment.

What You Should Do

• For Developers and Architects: Implement robust cryptographic signature validation for all JWTs. Never trust claims in unsigned tokens or tokens signed with “none” algorithms.
• For Security Teams: Conduct regular audits of authentication mechanisms, especially those relying on tokens, to ensure all security best practices are followed.
• For Organizations: Emphasize responsible disclosure programs and incentivize researchers for identifying critical vulnerabilities before they are exploited maliciously.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.