TLDR Tech / InfoSec
I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID
A security researcher registered as a FIFA player agent and was silently added to FIFA's internal Microsoft Entra tenant, which unlocked access to the live Football Data Platform and Streaming Management panel during World Cup 2026. With a low-privilege “NO_ROLES” account, they could see RTMP ingest URLs, stream keys, and controls to start or stop every live match feed, plus edit live stats, kick-off times, and commentary data used on broadcast systems. They confirmed live access via VLC, then spent the night escalating to FIFA, MediaKind, HBS, CISA, and the FBI until the issue was finally patched the next day, without any acknowledgment from FIFA.
Read the full story