- Researcher “BobDaHacker” found FIFA API flaw letting anyone hijack live TV streams and commentator feeds
- Bug stemmed from lack of authorization checks; FIFA patched quickly but did not credit the finder
- Experts warn it highlights CWE‑602 and the danger of confusing authentication with authorization
A bug in an internal FIFA system allowed anyone to modify what gets streamed to TV broadcasters, and what goes to TV commentators narrating the FIFA 2026 World Cup matches. Luckily for everyone, the bug was discovered by a white hat hacker and remedied before any malicious actors could leverage it.