I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
1–10 of 109 posts
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#2Registered on FIFA's public Agent Platform with my ID, got added to their Microsoft Entra tenant, and found the Angular app only checked roles client-side. The backend APIs served everything: RTMP ingest URLs and stream keys for every live World Cup 2026 camera feed across all five angles. Confirmed live in VLC. An attacker could have pushed arbitrary video to the ingest endpoints and replaced broadcast feeds on TV worldwide. Write access to match stats, commentator notes, and the live score system was also exposed.
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#3[deleted]
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#4Registered on FIFA's public Agent Platform with my ID, got added to their Microsoft Entra tenant, and found the Angular app only checked roles client-side. The backend APIs served everything: RTMP ingest URLs and stream keys for every live World Cup 2026 camera feed across all five angles. Confirmed live in VLC. An attacker could have pushed arbitrary video to the ingest endpoints and replaced broadcast feeds on TV w…
Could have made a killing off of poly market and rick rolled ftw.
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#5How could that possibly, ever have made it through. Every single API for every single service didn't check the JWT?
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#6Really amusing to read this one. I did something similar for Qatar 2022 and got access to roster submission (https://zachholman.com/posts/hacking-fifa). To their credit they patched it pretty quickly, but their promised "token of appreciation" never came. (Although on the other hand, they didn't sue me, so I guess that's a win.)
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#7Awesome read! Congratulations on discovering this and reporting. Hope you get something back from FIFA. This could've lead to some huge disaster if it failed under the wrong hands.
Love your writing skills as well!
> I closed it immediately. But the damage was done (to my brain).
Laughed so hard when I read this one :D
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#8Awesome read! Congratulations on discovering this and reporting. Hope you get something back from FIFA. This could've lead to some huge disaster if it failed under the wrong hands. Love your writing skills as well! > I closed it immediately. But the damage was done (to my brain). Laughed so hard when I read this one :D
It was a cool story, no doubt.
> Love your writing skills as well!
I‘d say it was heavily AI assisted
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#9Registered on FIFA's public Agent Platform with my ID, got added to their Microsoft Entra tenant, and found the Angular app only checked roles client-side. The backend APIs served everything: RTMP ingest URLs and stream keys for every live World Cup 2026 camera feed across all five angles. Confirmed live in VLC. An attacker could have pushed arbitrary video to the ingest endpoints and replaced broadcast feeds on TV w…
Could have made a killing off of poly market and rick rolled ftw.
Given that they had to hand over their identity to get access, seems like a 1-way ticket to prison (assuming FIFA logs events like that, which honestly I’m not so sure about anymore).
Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
#10Holy crap. Had to pick my jaw up off the floor. I hope you get some kind of acknowledgement or bounty for this. Kudos for having the willpower to resist sending a message to millions of people and sparking a global phenomenon!