Security Researcher Found FIFA World Cup Bug That Could Have Let Anyone Hijack TV Broadcasts

A security researcher discovered a flaw in FIFA’s online platforms in June 2026 that could have allowed an attacker to take control of the live TV stream for every World Cup match simultaneously.

The researcher, known online as BobDaHacker, said she gained access to multiple internal FIFA systems by exploiting a gap in the organization’s back-end API. The flaw failed to verify whether a logged-in user had the proper authorization to access restricted systems. BobDaHacker said she began simply by registering as a player agent on FIFA’s official agent registration platform — a process open to the public — and used that account to move deeper into FIFA’s infrastructure.

Among the systems she accessed was the platform that controls what is displayed on TV screens for broadcast audiences around the world, as well as what appears on commentators’ screens during matches. “A single attacker could hijack every camera simultaneously. An attacker could have rickrolled the entire FIFA World Cup,” BobDaHacker wrote in a blog post published Tuesday.

BobDaHacker reported the vulnerability to FIFA on Tuesday night Japan time. FIFA patched the issue within a few hours but did not acknowledge the researcher’s report. FIFA also did not respond to a request for comment from TechCrunch, which first reported the story.

The incident highlights how a basic authorization failure — one of the most common categories of API security flaws — could have had consequences on a global scale, potentially disrupting broadcasts watched by millions of viewers across the world during one of sports’ largest events.