Microsoft Titan
An internal service system operated by Microsoft. A security vulnerability was disclosed involving a JWT signature verification flaw and the misuse of the upn (user principal name) field, which exposed weaknesses in the system's authentication mechanism.
Timeline (last 90 days)
A security researcher successfully accessed an internal service of Microsoft Titan by setting the JWT's upn claim to admin.
The root cause of the vulnerability was that the internal service did not properly validate the token signature and simultaneously used upn as a local lookup key.
All Facts (2)
The root cause of the vulnerability was that the internal service did not properly validate the token signature and simultaneously used upn as a local lookup key.
50%UnverifiedA security researcher successfully accessed an internal service of Microsoft Titan by setting the JWT's upn claim to admin.
50%