FIFA patches flaw that have hijacked World Cup streams

A significant security vulnerability in FIFA's internal systems allowed a researcher to gain control over the global television broadcasts for the 2026 World Cup, according to a report published this week. The flaw, which has since been fixed, could have enabled a malicious actor to hijack live match streams and manipulate official match data.

The researcher, who uses the alias BobDaHacker, discovered the issue on June 14. By registering as a prospective football agent on FIFA's official agent platform, the researcher's account was added to FIFA's Microsoft Entra identity management system. While the website's front end displayed access-denied messages for unauthorized users, the backend API lacked proper authorization checks. This allowed any authenticated account to access sensitive internal platforms.

The most critical exposure was to FIFA's streaming management panel, which controls the live video feeds distributed to broadcasters worldwide. The researcher found they could have stopped the main program feed or replaced it with any other video content during an active match. Access was also granted to systems controlling match statistics, official kickoff times, tactical...