# FIFA World Cup 2026 Broadcast API Broken Access Control (Missing Server-Side Authorization) Allowed Live TV Stream Takeover

> A broken-access-control flaw in FIFA's back-end APIs let anyone who completed the public football-agent registration on fdp.fifa.org obtain a Microsoft Entra tenant account that, despite carrying a NO_ROLES marker, was served full data by unprotected backend APIs. Researcher BobDaHacker reached FIFA's Streaming Management Panel (RTMP ingest URLs and stream keys for every World Cup 2026 match camera), the Commentator Information System, and match-management write APIs, demonstrating the ability to hijack and replace live broadcast feeds before FIFA patched the issue within hours of disclosure on 2026-06-16.

- **Published:** 2026-06-16T00:00:00Z
- **Last reviewed:** 2026-06-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0859
- **ID:** TL-2026-0859
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Actor:** BobDaHacker
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 16 June 2026, independent security researcher BobDaHacker publicly disclosed a critical broken-access-control vulnerability spanning multiple internal FIFA platforms used to operate the 2026 FIFA World Cup. The root cause was client-side-only authorization with no server-side enforcement (OWASP API1:2023 / A01:2021): FIFA's Angular front-ends inspected the user's JSON Web Token for a 'NO_ROLES' marker and rendered an access-denied page, but the corresponding backend APIs performed no authorization checks at all and returned full production data to any authenticated member of FIFA's shared Microsoft Entra ID (formerly Azure AD) tenant.

The attack path required no exploit primitive beyond legitimate self-registration. Subdomain enumeration of fifa.org surfaced the public prospective-agent registration portal (agents.fifa.org / the Football Data Platform fdp.fifa.org). Completing the agent registration automatically provisioned the researcher's account into FIFA's central Entra tenant, which is shared across internal systems. Because authorization was never validated server-side, that low-privilege 'NO_ROLES' account could call backend APIs belonging to systems it should never have touched.

The most severe exposure was FIFA's Streaming Management Panel, which listed every World Cup 2026 fixture together with five camera angles per match (PGM/program, Tactical, Camera1, High Behind Left, High Behind Right), preview manifests, HLS output URLs, and the RTMP ingest URLs and stream keys (pattern rtmp://in-[UUID].[region].streaming.mediakind.com:1935/[stream-key], operated by FIFA broadcast partner MediaKind). A single shared stream key per match covered all five angles, meaning an attacker who pushed video to the RTMP ingest endpoint with the stream key could replace the live camera feed delivered to TV networks worldwide. The researcher confirmed read access by opening a preview manifest in VLC and viewing a live tactical feed from an active match, and summarized the impact as being able to 'rickroll the entire FIFA World Cup' on every broadcast simultaneously.

Additional reachable systems included the Commentator Information System (cis.fifa.org) exposing pre-match statistics kits, editorial notes, live tactical positions, formations and substitution timelines; match-management APIs offering write access to live statistics, scores, official kick-off times and tactical lineups; and a 'spreadsheets' Azure Function App (a *-spreadsheets-api.azurewebsites.net endpoint) that returned Azure Blob Storage (*.blob.core.windows.net) URLs for ~23 internal files including transfer reports and financial data.

FIFA operates no bug-bounty program and lists no security contact, so disclosure required escalation: direct FIFA emails bounced or went unanswered and a WhatsApp message to FIFA's Head of Football Technology (Sebastian Runge) drew no reply, so the researcher notified MediaKind (which answered a toll-free line and requested a detailed report including stream keys), CISA's 24/7 operations center, and the FBI via Signal. FIFA patched the flaw overnight by adding server-side role validation — the researcher's account afterward received 403 responses from the server itself rather than only the client — but never acknowledged the report, offered no compensation, and left the researcher on operational email distribution lists. No CVE was assigned and no CVSS score was published; no malicious in-the-wild exploitation was reported.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1596 Search Open Technical Databases
- T1585 Establish Accounts
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1136 Create Account
- T1526 Cloud Service Discovery
- T1538 Cloud Service Dashboard
- T1580 Cloud Infrastructure Discovery
- T1087 Account Discovery
- T1528 Steal Application Access Token
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1565 Data Manipulation
- T1491 Defacement

## Sources

- [I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.](https://bobdahacker.com/blog/fifa-hack)
- [Bug in FIFA World Cup internal system gave anyone ability to modify TV stream](https://techcrunch.com/2026/06/16/bug-in-fifa-world-cup-internal-system-gave-anyone-ability-to-modify-tv-stream/)
- [FIFA Bug Exposed World Cup Streams to Remote Takeover](https://www.darkreading.com/application-security/fifa-bug-world-cup-streams-remote-takeover)
- [Access control flaw left FIFA World Cup match streams wide-open](https://www.itnews.com.au/news/access-control-flaw-left-fifa-world-cup-match-streams-wide-open-626688)
- [Security researcher reportedly accesses FIFA World Cup broadcast controls via API flaw](https://www.scworld.com/brief/security-researcher-accesses-fifa-world-cup-broadcast-controls-via-api-flaw)
- [Hacker: 'I Could Have Rickrolled the World Cup'](https://www.bankinfosecurity.com/hacker-i-could-have-rickrolled-world-cup-a-31987)
- [A basic security flaw let a security researcher access internal FIFA systems](https://www.techradar.com/pro/security/a-basic-security-flaw-let-a-security-researcher-access-internal-fifa-systems-and-the-ability-to-control-world-cup-tv-streams)
- [OWASP API Security Top 10 — API1:2023 Broken Object Level Authorization / API5 Broken Function Level Authorization](https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0859