Teenager hacks open Microsoft database with 17 trillion total rows and 25,000 user accounts — custom AI bot and lack of JWT token validation yields a fruitful trove, earns $5,000 bug bounty
Nyxfrom the teenage-penetration-tester-arc dept.
A teenager discovered a flaw in Microsoft's database access controls that exposed a large dataset containing millions of records and thousands of user accounts. The vulnerability stemmed from improper JWT token validation, which the researcher exploited using a custom AI tool. Microsoft paid a $5,000 bug bounty for the disclosure.