[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-teen-hacker-exposes-microsoft-database-flaw-for-5000-bounty":10,"sections":40},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":35,"feedback":39,"feedback_at":22,"cost_usd":39,"total_tokens":39},10249,"teen-hacker-exposes-microsoft-database-flaw-for-5000-bounty","Teen Hacker Exposes Microsoft Database Flaw for $5,000 Bounty","A 16-year-old researcher bypassed Microsoft's token checks to reach an internal database of trillions of rows, exposing a signature flaw Microsoft missed.","A 16-year-old bug hunter walked into an internal Microsoft database using a login token the system never bothered to verify.\n\nFaav, who publishes under that handle, found that Microsoft's internal Titan analytics platform checked a JSON Web Token's tenant, audience, and application ID, but never checked the cryptographic signature meant to prove the token was real. After failed attempts using guessed email addresses, he swapped the token's user field for the plain string admin, which Titan resolved to a local admin account. That gave him access to an estimated 17.3 trillion stored rows and a metadata table listing roughly 25,000 accounts, reachable through an undocumented API endpoint that accepted raw SQL queries. He reported the bug on September 5, Microsoft patched it by September 9, and paid him $5,000 on September 17.\n\nThe real story isn't the eye-catching row count, which Microsoft calls a theoretical storage estimate rather than proof anyone's data was touched. It's that one unchecked signature made three other layers of access control pointless, the security equivalent of a hotel where every door has a working card reader but any card opens any room. It's also worth remembering Microsoft had editorial input on Faav's write-up before he published it, trimming details and reshaping how the impact was described.\n\nThis isn't Faav's first Microsoft disclosure, and he has separately found and reported bugs at Amazon, Google, and Adobe.","[\"security\",\"microsoft\",\"bug-bounty\",\"hacking\"]","2026-10-05T21:10:00.000Z","2026-10-06T11:10:59.442Z","2026-10-06T11:11:04.801Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Rewrite the final sentence ('a modest bounty and a tidy narrative... not his first at a company that also includes Amazon, Google, and Adobe among his past targets') which is a garbled run-on that doesn't parse grammatically — clarify that this isn't Faav's first Microsoft disclosure and that he has separately hit Amazon, Google, and Adobe.","resolved","security",[30,32,33,34],"microsoft","bug-bounty","hacking",[36],{"name":37,"url":38},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fopen-microsoft-database-with-17-trillion-total-rows-and-25-000-user-accounts-hacked-by-a-bored-teenager-but-hes-been-well-paid-for-his-actions",0,{"sections":41},[42,47,51,56,61,66,71,76,81,86,91,96,101,106],{"name":43,"slug":44,"count":45,"latest_published_at":46},"AI","ai",6347,"2026-10-06T07:49:07.000Z",{"name":48,"slug":30,"count":49,"latest_published_at":50},"Security",879,"2026-10-06T00:00:38.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Policy","policy",463,"2026-10-05T23:16:24.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Deals","deals",373,"2026-10-06T08:09:42.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Hardware","hardware",211,"2026-10-05T21:14:08.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Science","science",182,"2026-10-05T18:58:12.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Consumer Tech","consumer-tech",162,"2026-10-06T09:00:14.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Software","software",103,"2026-10-05T18:23:19.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Dev Tools","dev-tools",99,"2026-10-05T10:47:06.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Startups","startups",96,"2026-10-05T20:24:09.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Gaming","gaming",54,"2026-10-05T19:07:04.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"General","general",53,"2026-10-05T22:05:42.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"Reviews","reviews",33,"2026-10-05T11:57:17.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]