Teen Hacker Finds Auth Flaw in Microsoft System With 17.3 Trillion Data Rows

**Summary:** A 16-year-old researcher discovered that Microsoft’s internal Titan analytics API failed to verify JWT signatures, allowing unsigned tokens to be used to impersonate an admin and execute SQL queries against metadata (the report noted an estimated 17.3 trillion stored rows based on metadata); the issue was reported to MSRC, the API was locked down, a $5,000 bounty was paid, and no evidence of malicious exploitation or customer data access was reported.