16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows
“Titan validated the contents of the JWT (tenant, audience, app ID, user) but never verified the signature, the most important part of any authentication check.”