A token with no signature and the word admin in it reached seventeen trillion rows of Microsoft's own data
2026-10-05Security
Titan, Microsoft's internal analytics service, checked a login token's tenant, audience, application and user — and never checked that it was signed. A 16-year-old researcher set the algorithm to none, typed admin into the user field, and was one. Microsoft blocked the endpoint in four days and paid 5,000 dollars.
