tl;dr: A 16-year-old researcher found that Microsoft's internal "Titan" analytics API validated JWT claims (tenant, audience, app ID) but never checked token signatures, allowing an unsigned token with `upn: admin` to execute SQL as administrator. This exposed roughly 17.3 trillion rows across 17 connected databases, including employee records and Bing search analytics. Microsoft patched it within four days of the report, paid a $5,000 bounty, and exercised editorial control over the published writeup.