via TechCrunch
FIFA 2026: Critical API Flaw Allowed Unauthorized Control of World Cup TV Streams
A critical security vulnerability in FIFA's internal systems could have allowed an attacker to take full control of the World Cup television broadcast, potentially affecting millions of viewers worldwide. The flaw, discovered by a security researcher known as BobDaHacker, exposed a significant gap in FIFA's backend API authorization checks.
According to the researcher, the exploit chain began with a simple registration as a player agent on FIFA's official agent platform. Once that account was active, the researcher discovered that FIFA's backend API failed to verify whether users had the necessary authorization to access internal systems. This allowed her to bypass access controls and reach several sensitive platforms.
One of the most alarming capabilities was access to the system used by broadcasters to manage the live television feed. This system controls what is displayed on viewers' screens around the world, as well as the camera feeds seen by commentators during match narration. “A single attacker could hijack every camera simultaneously. An attacker could have rickrolled the entire FIFA World Cup,” BobDaHacker wrote in a blog post published on Tuesday.
The researcher reported the flaw to FIFA on Tuesday night Japan time. The organization patched the vulnerability within a few hours but did not acknowledge the researcher's report. FIFA did not immediately respond to TechCrunch's request for comment.
As the world looks toward the FIFA 2026 World Cup, which will be hosted across the United States, Canada, and Mexico, this incident underscores the critical importance of robust API security and authentication checks in large-scale global events. The 2026 tournament will feature an expanded format with 48 teams and matches in 16 cities, making the attack surface for such vulnerabilities even larger. Organizers must ensure that all internal systems—especially those controlling broadcast infrastructure—are hardened against unauthorized access to prevent potential disruptions or malicious manipulation of the viewing experience.