By Sinisa Markovic
Publication Date: 2026-09-28 13:50:00
A flaw in Titan, an internal Microsoft analytics service, could have let an attacker read employee records and Bing search analytics, a 16-year-old security researcher has disclosed.
The researcher, who goes by Faav, found that Titan did not verify the signature on login tokens. That let him pose as the service’s administrator and run SQL queries against 17 connected databases holding an estimated 17.3 trillion rows.
He did this with the help of Antares, an automated bug-hunting tool he built himself. His write-up says Antares flagged Titan and spent ten days working through its login checks before he took the final step himself.
“Antares wouldn’t have gotten here alone, and neither would I. Its persistence, plus one human hunch, is what made this find possible.”
Getting past the token checks
Titan’s web interface was only reachable over a Microsoft VPN, but Antares found a separate API endpoint with public documentation. One of its routes, /v2/Query, accepted…