A researcher reached an internal Microsoft service by setting a JWT’s upn claim to admin. The missing signature was the door. The lookup key was the bug.
Microsoft Titan JWT bug: Never use upn as a local username
calendar_today
October 1, 2026
domain
workos