FIFA World Cup Internal System Bug Exposed Live Broadcast Streams to Unauthorized Control
A security researcher identified a critical flaw in FIFA's internal systems, allowing unauthorized access and potential modification of live World Cup broadcast streams and commentator screens. The vulnerability, which stemmed from an API flaw linked to the official player agent registration platform, was reportedly fixed by FIFA within hours of its disclosure.
Tumisang Bogwasi
Tumisang Bogwasi
TOKYO, JAPAN A significant security vulnerability within FIFA’s internal systems granted unauthorized individuals the ability to access and potentially manipulate live broadcast streams for the World Cup, according to a report by a security researcher. The flaw, detailed by an individual identified as BobDaHacker, raised concerns over the digital integrity of one of the world’s largest sporting events, as reported by TechCrunch.
Highlights
- Security researcher BobDaHacker gained unauthorized access to FIFA’s broadcast control platforms.
- The flaw allowed potential manipulation of live World Cup television streams globally.
- Access was secured via a loophole in the FIFA agent registration system and back-end API.
- FIFA reportedly rectified the vulnerability within hours of its disclosure on June 16, 2026.
- The incident highlights operational cybersecurity risks for major global sporting events.
BobDaHacker claimed access was achieved by registering as a player agent on FIFA’s official platform, then exploiting an API flaw that failed to verify proper user authorization. This oversight granted entry to multiple internal FIFA systems, including those that control broadcast content displayed on televisions worldwide and commentator screens during matches, the researcher stated.
FIFA operates an official Football Agent Platform for registration and compliance, governed by its Regulations on Football Agents.
The researcher asserted that a single attacker could have simultaneously hijacked every camera feed, potentially leading to widespread disruption, including what BobDaHacker termed a
