GoKawiilResearcher finds Microsoft internal API flaw exposing 17T database rows
Security researcher Faav discovered that an internal Microsoft analytics service failed to verify the signature on login tokens, allowing anyone to impersonate an administrator and run unauthorized SQL queries. Faav says the flaw could have exposed roughly 17.3 trillion rows across multiple Microsoft datasets, but reported it through Microsoft's Bug Bounty Program without accessing customer data or PII. Microsoft confirmed it investigated and hardened the affected service in response.
GoKawiil's interpretation of the reporting above, not reported fact.
The case illustrates how a single unverified authentication check in an internal tool can theoretically expose vast amounts of data at large cloud providers, even without a breach ever occurring. Microsoft's decision to have editorial input on the published account suggests the company is managing how such findings are publicly framed, which could shape public perception of the actual risk. The disclosure also highlights the growing role of AI-assisted tools, like Faav's 'Antares' bot, in modern vulnerability research.
- A token signature-verification flaw let a researcher impersonate an admin on an internal Microsoft analytics API.
- The theoretical exposure covered an estimated 17.3 trillion database rows, though no customer data was actually accessed.
- Microsoft confirmed the report through its Bug Bounty Program and hardened the affected service, while also reviewing the published account before release.
YubiKey 5C NFC Security Key — This article highlights how broken authentication and token validation can expose massive amounts of data. A hardware security key like the YubiKey adds a strong, phishing-resistant layer of identity verification that's much harder to bypass than software tokens alone. It's a practical step anyone can take to harden their own accounts against the kind of authentication flaws described here.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: blog.faav.net, 2026-09-28
Published there as: “I Could've Accessed 17T Microsoft Records”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.