TL;DR: A security researcher using the handle BobDaHacker registered for a football-agent license on FIFA's public agents.fifa.org portal, uploaded a government ID, and was silently added to the same Microsoft Entra tenant that powers FIFA's internal Football Data Platform. The client-side access check said "Access Denied." The backend said "here is every match, every camera angle, every RTMP ingest URL, every stream key, and a start/stop button for all of it." He opened a live match feed in VLC to confirm, then called FIFA, MediaKind, HBS, CISA, and the FBI at 3 a.m. Tokyo time to disclose. FIFA fixed the bug the next day. They never replied.[1]
It Started With a Football Agent Application
FIFA runs a public portal at agents.fifa.org where anyone can apply to become a licensed football agent. You submit a government ID, verify your email, and you are in. That is the entire onboarding flow.[1]
What the registration page does not tell you is what happens on the back end. FIFA adds the new account to its Microsoft Entra tenant, the directory that used to be called Azure Active Directory.[3] It is not a sandboxed tenant. It is the same tenant that authenticates every user on every internal FIFA application, including the Football Data Platform at fdp.fifa.org, the Commentator Information System at cis.fifa.org, and a dev environment at a Microsoft-hosted Azure App Service.[1]
BobDaHacker's first two ID uploads failed because the photo lighting was not good enough. The third one went through. The confirmation email subject line read: "FIFA - FAP - CONFIRMATION." (Yes, FIFA's Agent Platform is officially called FAP. He did not make that up.)[1]
The "Access Denied" That Was Lying
Once registered, he navigated to fdp.fifa.org. The app loaded. Entra authenticated him. His account had no role, and the page rendered: "Sorry, you do not have any FIFA Football Data Platform role assigned to your account."[1]
That looked like a working access control. It was not. The Angular front end was reading a NO_ROLES claim out of his JWT and choosing to render the "Access Denied" page. The backend APIs never checked the claim. They served whatever the logged-in tenant member asked for.[1]
This is the worst possible place to fail at access control. The client cannot enforce permissions, because the client runs on the attacker's computer. The server is the only thing that matters, and the server was not checking.[1]
Welcome to the Streaming Management Panel
Behind the access-denied curtain sat the Streaming Management panel. Every match on the 2026 World Cup schedule. Five camera angles per match, labeled PGM, Tactical, Camera1, High Behind Left, and High Behind Right. Each angle had three URLs: an RTMP ingest endpoint (where the stadium camera pushes video), a preview manifest (where you can watch the live feed), and an HLS output URL (where broadcast partners pull the stream).[1]
The RTMP URL ended in a UUID that was the stream key. The same key was shared across all five camera angles for any given match. With that one key, you could push replacement video into the broadcast chain. Camera to ingest to MediaKind (FIFA's streaming technology partner) to broadcast partners to TVs worldwide.[1]
To confirm the preview manifests actually worked, he copied one into VLC. A live tactical camera feed from an active 2026 World Cup match. Playing in VLC. On his PC. In Tokyo. He closed it immediately.[1]
Start, Stop, Schedule: The Write Access
Read access was bad enough. The panel also had write controls. Start stream. Stop stream. Schedule stream. One click each, applied to every match and every camera angle, accepted by a backend that was not checking roles.[1]
He did not touch any of them. But the buttons were functional, and a NO_ROLES account was authorized to press them. The same attack chain that put him in the panel would have put anyone else in the panel. The PGM (Program) feed is the main broadcast output. Replace that, and every TV network receiving FIFA's feed displays whatever you pushed. He had the keys. He had the access. He had the receipts.[1]
The exposed platform was not limited to streaming. The same NO_ROLES account could see Competitions, Matches, Teams, Tools, Exchange Platform, Analysis Dashboard, Commentator Information System, FIFA AI Pro, and the Admin section. A live match dashboard included an embedded video player, a real-time event timeline, and match officials data. The Match Management tab accepted write operations, including a rich-text "Update Live Stats" editor that the backend would have published.[1]
Ten Calls, 3 a.m. Tokyo Time
He tried to disclose responsibly. He sent a disclosure email to more than ten FIFA addresses. Five bounced. He WhatsApped Sebastian Runge, a contact at FIFA, and got no reply. He called FIFA's Zurich line. Closed. He called FIFA's media line. Closed. He called the Dallas Convention Center, hoping the local organizing committee would answer. Voicemail.[1]
The breakthrough was MediaKind. Their toll-free line at +1 833 211 8472 actually had a human on the other end of it. They understood the issue, asked for the stream keys as proof, and took the report.[1]
Host Broadcast Services (HBS) was less helpful. He called +41 41 726 0090. They said they did not have anyone who could help and hung up. He called Infront Sports and Media, HBS's parent, at +41 41 723 15 15. No answer.[1]
CISA, the Cybersecurity and Infrastructure Security Agency, is the federal lead on cybersecurity for the 2026 World Cup, including the broadcast systems. He called their 24/7 operations center at +1 888 282 0870. They picked up. They listened. They asked for the written report.[1]
The FBI responded over Signal via existing contacts. They said they had the right people and would package the disclosure properly.[1]
Fixed, but Silent
Sometime between the reports and the next morning, the vulnerability was patched. His NO_ROLES account now returns 403 from the server, not just the client. Server-side enforcement is the only thing that ever should have been there in the first place.[1]
FIFA never responded. Not to acknowledge the report. Not to say thank you. Not to discuss compensation. Nothing.[1]
He is, however, still on the FDP email distribution list. He is still receiving official FIFA World Cup 2026 match documents: Start Lists, Tactical Lineups, Full Time Match Reports. All sent from an FDP address. In four languages.[1]
The Third Security-by-ID Story in 12 Hours
The pattern is the story. FIFA's public ID check was supposed to be a gate. It was a back door into the broadcast control plane of the largest sporting event on earth. Any platform that asks for a government ID, and then shares that ID's authentication context with internal infrastructure, is creating an attack surface that did not exist before the ID check went in.[1]
It is not the only one. Within a 12-hour window, three different security-by-ID stories crossed the same surveillance beat: a LinkedIn backdoor that let attackers impersonate recruiters by abusing npm-published job posts, the UK government's Apple and Google ID verification push under the Online Safety Act, and now the FIFA Agent Platform. The common thread is that the ID check is the vulnerability. Each platform treated identity verification as a feature to be layered onto existing infrastructure. The infrastructure was the part that was not ready.[2]
Client-side authorization is not authorization. Every intern learns this. When a researcher has to call CISA and the FBI at 3 a.m. to reach you, the security program you actually have is the one CISA and the FBI run for you. That is not a vulnerability disclosure policy. It is a confession.[1]
What You Should Do With This Information
You are not the customer of FIFA's Streaming Management panel. You are not the threat model BobDaHacker was writing about. But you are the threat model for the same pattern in every other ID-gated platform you use.
Three steps, all of which apply the same way to the LinkedIn backdoor and the UK Online Safety Act ID check:
- Read the threat model, not the marketing. When a platform advertises "we verify your ID with a government document," ask which tenant that ID lands in and which internal apps trust that tenant. If you cannot get an answer, assume the worst.
- Push for security.txt and a published VDP. FIFA does not have a security.txt file. It is 2026. Publish a vulnerability disclosure policy. You are running the biggest sporting event on earth, or, more likely, a much smaller platform with the same architectural mistake.
- Treat ID uploads as the highest-risk thing you do on a platform. Once your ID is in a vendor's tenant, your authentication is bound to whatever that tenant protects. If the vendor's role checks are client-side, your ID is the attack surface.
BobDaHacker did not push to any RTMP endpoint. He did not write to any match management API. He called CISA. He is the responsible-disclosure version of the same threat that, in less careful hands, would have put Subway Surfers gameplay on every TV on the planet during a World Cup final.[1]
References
- BobDaHacker - I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID (June 16, 2026)
- Hacker News - I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID (202 points, 71 comments, June 16, 2026)
- Microsoft Learn - What is Microsoft Entra ID (formerly Azure Active Directory)