FIFA World Cup 2026 Broadcast API Broken Access Control (Missing Server-Side Authorization) Allowed Live TV Stream Takeover

FIFA World Cup 2026 Broadcast API Broken Access Control (TL-2026-0859), also tracked as I Could've Rickrolled the Entire FIFA World Cup, is a high-severity software vulnerability, first published 2026-06-16. It is attributed to BobDaHacker with high confidence, affects FIFA FIFA Football Data Platform / Agent Registration (fdp.fifa.org, maps to 16 MITRE ATT&CK techniques (T1078, T1087, T1136), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-0859

Threat ID
TL-2026-0859
Also known as
I Could've Rickrolled the Entire FIFA World Cup, FIFA World Cup 2026 Stream Takeover
Severity
HIGH
Status
PATCHED
Category
VULNERABILITY
First published
2026-06-16
Last reviewed
2026-06-16
Attribution
BobDaHacker
Attribution confidence
HIGH
Motivation
UNKNOWN
Target sectors
sports, media, broadcasting, entertainment
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
19

Malware and tooling in FIFA World Cup 2026 Broadcast API Broken Access Control

Malware and tooling: VLC media player

A broken-access-control flaw in FIFA's back-end APIs let anyone who completed the public football-agent registration on fdp.fifa.org obtain a Microsoft Entra tenant account that, despite carrying a NO_ROLES marker, was served full data by unprotected backend APIs. Researcher BobDaHacker reached FIFA's Streaming Management Panel (RTMP ingest URLs and stream keys for every World Cup 2026 match camera), the Commentator Information System, and match-management write APIs, demonstrating the ability to hijack and replace live broadcast feeds before FIFA patched the issue within hours of disclosure on 2026-06-16.

How FIFA World Cup 2026 Broadcast API Broken Access Control works

On 16 June 2026, independent security researcher BobDaHacker publicly disclosed a critical broken-access-control vulnerability spanning multiple internal FIFA platforms used to operate the 2026 FIFA World Cup. The root cause was client-side-only authorization with no server-side enforcement (OWASP API1:2023 / A01:2021): FIFA's Angular front-ends inspected the user's JSON Web Token for a 'NO_ROLES' marker and rendered an access-denied page, but the corresponding backend APIs performed no authorization checks at all and returned full production data to any authenticated member of FIFA's shared Microsoft Entra ID (formerly Azure AD) tenant.

The attack path required no exploit primitive beyond legitimate self-registration. Subdomain enumeration of fifa.org surfaced the public prospective-agent registration portal (agents.fifa.org / the Football Data Platform fdp.fifa.org). Completing the agent registration automatically provisioned the researcher's account into FIFA's central Entra tenant, which is shared across internal systems. Because authorization was never validated server-side, that low-privilege 'NO_ROLES' account could call backend APIs belonging to systems it should never have touched.

The most severe exposure was FIFA's Streaming Management Panel, which listed every World Cup 2026 fixture together with five camera angles per match (PGM/program, Tactical, Camera1, High Behind Left, High Behind Right), preview manifests, HLS output URLs, and the RTMP ingest URLs and stream keys (pattern rtmp://in-[UUID].[region].streaming.mediakind.com:1935/[stream-key], operated by FIFA broadcast partner MediaKind). A single shared stream key per match covered all five angles, meaning an attacker who pushed video to the RTMP ingest endpoint with the stream key could replace the live camera feed delivered to TV networks worldwide. The researcher confirmed read access by opening a preview manifest in VLC and viewing a live tactical feed from an active match, and summarized the impact as being able to 'rickroll the entire FIFA World Cup' on every broadcast simultaneously.

Additional reachable systems included the Commentator Information System (cis.fifa.org) exposing pre-match statistics kits, editorial notes, live tactical positions, formations and substitution timelines; match-management APIs offering write access to live statistics, scores, official kick-off times and tactical lineups; and a 'spreadsheets' Azure Function App (a *-spreadsheets-api.azurewebsites.net endpoint) that returned Azure Blob Storage (*.blob.core.windows.net) URLs for ~23 internal files including transfer reports and financial data.

FIFA operates no bug-bounty program and lists no security contact, so disclosure required escalation: direct FIFA emails bounced or went unanswered and a WhatsApp message to FIFA's Head of Football Technology (Sebastian Runge) drew no reply, so the researcher notified MediaKind (which answered a toll-free line and requested a detailed report including stream keys), CISA's 24/7 operations center, and the FBI via Signal. FIFA patched the flaw overnight by adding server-side role validation — the researcher's account afterward received 403 responses from the server itself rather than only the client — but never acknowledged the report, offered no compensation, and left the researcher on operational email distribution lists. No CVE was assigned and no CVSS score was published; no malicious in-the-wild exploitation was reported.

MITRE ATT&CK techniques used in TL-2026-0859

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1087 Account Discovery; T1526 Cloud Service Discovery; T1538 Cloud Service Dashboard; T1580 Cloud Infrastructure Discovery

Persistence

T1136 Create Account

Collection

T1213 Data from Information Repositories; T1530 Data from Cloud Storage

Impact

T1491 Defacement; T1565 Data Manipulation

Credential Access

T1528 Steal Application Access Token

Resource Development

T1585 Establish Accounts

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning; T1596 Search Open Technical Databases

Affected products and versions in FIFA World Cup 2026 Broadcast API Broken Access Control

  • FIFA — FIFA Football Data Platform / Agent Registration (fdp.fifa.org, agents.fifa.org)
    Vulnerable versions: production as of 2026-06-16
    Fixed in: patched 2026-06-16 with server-side authorization
  • FIFA — FIFA Streaming Management Panel (World Cup 2026 broadcast control)
    Vulnerable versions: production as of 2026-06-16
    Fixed in: patched 2026-06-16
  • FIFA — Commentator Information System (cis.fifa.org)
    Vulnerable versions: production as of 2026-06-16
    Fixed in: patched 2026-06-16
  • MediaKind — MediaKind streaming RTMP ingest infrastructure (*.streaming.mediakind.com)
    Vulnerable versions: stream keys exposed via FIFA panel
    Fixed in: keys subject to rotation post-disclosure
  • Microsoft — Microsoft Entra ID (Azure AD) tenant used by FIFA internal platforms
    Vulnerable versions: misconfigured: public registration provisioned tenant accounts
    Fixed in: server-side role enforcement added

Remediation for FIFA World Cup 2026 Broadcast API Broken Access Control

Patches

  • FIFA deployed server-side role validation on the affected backend APIs within hours of disclosure; NO_ROLES accounts now receive HTTP 403 from the server

Immediate actions

  • Enforce authorization server-side on every backend API endpoint; never rely on client-side (Angular/JWT NO_ROLES) checks to gate access to data or actions
  • Rotate all RTMP stream keys and broadcast ingest credentials that may have been exposed via the Streaming Management Panel
  • Audit Microsoft Entra ID tenant membership and revoke or scope down accounts auto-provisioned by public registration flows

Workarounds

  • Restrict RTMP ingest endpoints and streaming-control panels to allow-listed broadcast operator networks/VPN
  • Require step-up authentication and explicit role assignment before any streaming or match-management API returns data

Longer-term hardening

  • Separate public-facing registration tenants/directories from internal production tenants so external self-registration cannot grant any internal access
  • Adopt least-privilege RBAC with default-deny on all APIs and continuous authorization (verify role/claim on each request, not at login)
  • Stand up a vulnerability disclosure program (VDP)/bug bounty and publish a security.txt contact to avoid disclosure escalation to law enforcement
  • Implement API gateway authorization policies and automated access-control testing (BOLA/BFLA) in CI

Weaknesses (CWE) in FIFA World Cup 2026 Broadcast API Broken Access Control

CWE-862, CWE-602, CWE-285, CWE-639

Timeline of FIFA World Cup 2026 Broadcast API Broken Access Control

  • FIFA World Cup 2026 tournament underway (hosted across North America), with live broadcast operations active for every match.
  • Beyond broadcast control, the researcher reaches a 'spreadsheets' Azure Function App that returns Azure Blob Storage URLs for ~23 internal FIFA files, including transfer reports and financial data, all served to the NO_ROLES account.
  • Researcher opens a preview manifest in VLC and confirms a live tactical camera feed from an active World Cup 2026 match is accessible, demonstrating broadcast-takeover capability.
  • With a 'NO_ROLES' account, the researcher finds backend APIs perform no server-side authorization and return full data: the Streaming Management Panel (RTMP ingest URLs/stream keys, five camera angles per match), the Commentator Information System (cis.fifa.org), match-management write APIs, and a spreadsheets Azure Function returning ~23 internal Blob Storage files.
  • Researcher BobDaHacker enumerates fifa.org subdomains, finds the public prospective football-agent registration portal (agents.fifa.org / fdp.fifa.org), and self-registers — auto-provisioning an account in FIFA's shared Microsoft Entra ID tenant.
  • Direct FIFA email/WhatsApp contact attempts fail (no bug bounty, no security contact); researcher escalates to MediaKind (toll-free line +1 833 211 8472), CISA 24/7 ops (+1 888 282 0870), and the FBI via Signal, providing a detailed report including stream keys.
  • FIFA never acknowledges the report, offers no compensation (it runs no bug-bounty program and lists no security contact), and leaves the researcher on internal operational email distribution lists — underscoring the absence of a vulnerability disclosure process.
  • BobDaHacker publishes the writeup ('I Could've Rickrolled the Entire FIFA World Cup'); TechCrunch, Dark Reading, iTnews, SC Media and others report the broken-access-control flaw.
  • FIFA deploys server-side role validation overnight; the researcher's NO_ROLES account now receives HTTP 403 from the server (not just the Angular client). FIFA does not acknowledge the report.

Sources cited for FIFA World Cup 2026 Broadcast API Broken Access Control

Threats related to FIFA World Cup 2026 Broadcast API Broken Access Control

Detection coverage for TL-2026-0859

As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0859 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats