I could have hacked the entire FIFA World Cup

▤ Summary

This article examines multiple security weaknesses across FIFA’s software and data platforms, including agents.fifa.org, fdp.fifa.org, and related Azure-hosted services. It describes how exposed URLs, weak role controls, and configuration issues could let an attacker access sensitive streams, spreadsheets, and internal functionality. The write-up also references FIFA’s use of Microsoft Entra, MediaKind, and security.txt disclosure contacts. The overall focus is on application security, access control, and responsible disclosure rather than on a new product or corporate event.

▦ Linked Companies

MediaKind

$100M to $250M

Microsoft Corporation

$1B+