← Thursday, October 1, 2026SecurityVulnerability
Unsigned login token could have enabled SQL access to 17.3 trillion Microsoft records
A missing token-signature check let the researcher claim an administrator identity and submit unauthorized SQL queries to an internal analytics service; the 17.3 trillion-row reach is described as potential impact. The case shows how a single authentication check can affect a broad data service.
- What
- An unsigned login token could have enabled unauthorized SQL access to data across Microsoft datasets; the reported impact was hypothetical.
- How
- The Titan API's /v2/Query route accepted raw SQL, and the flaw was that the service did not check a login token's signature.
- Why it matters
- Verifying token signatures and enforcing authorization on query endpoints are critical safeguards for analytics services.
Read on blog.faav.net → Hacker News · 121 comments
Discussion
Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.
Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.
