A security researcher known as Bob the Hacker says he found a serious flaw in FIFA systems that could have allowed anyone on the internet to take control of World Cup broadcast infrastructure. The report, published on his blog over the past few days, says the problem was found in FIFA's official player-agent portal and exposed production control tools for the 2026 World Cup.
According to the researcher, registration on the portal required only a standard ID check. That account then granted access inside FIFA's cloud environment, and although the user interface appeared to block entry, the back-end API did not enforce proper authorization. As a result, the researcher says he reached the full production dashboard.
The access allegedly extended to the system that controls stadium cameras, camera angles and live feeds, meaning a malicious user could theoretically replace the official match broadcast with unrelated or offensive content on global television networks. The flaw also exposed real-time statistics systems and internal commentator notes, which the article says could be valuable in sports betting.
The story says FIFA closed the vulnerability after the researcher contacted it, but has otherwise remained silent. It also says the researcher had to spend a long night phoning international law-enforcement and intelligence agencies before anyone took the report seriously. The article argues the incident highlights how the shift to IP-based broadcasting has widened the attack surface for major sports events.
