FIFA’s World Cup streaming controls exposed through agent registration loophole
A security researcher signed up as a FIFA player agent and was automatically added to FIFA’s Microsoft Entra tenant. By bypassing client‑side checks, he accessed the live Football Data Platform and the Streaming Management panel, exposing every World Cup match’s camera feeds and stream keys. The flaw shows how external registrations can grant unchecked internal access.