A security researcher found a flaw in FIFA’s online platforms that gave her access to several internal systems, including one that could have allowed her to take control of the television broadcast stream of every World Cup match.

The vulnerability, disclosed as the 2026 FIFA World Cup got underway on June 11 across 16 host cities in the US, Canada, and Mexico, raises serious questions about the digital infrastructure underpinning one of the most-watched events in human history. The tournament runs through July 19, meaning weeks of matches could theoretically have been compromised.

What the flaw actually exposed

The researcher reported that the vulnerability granted access to internal FIFA systems, not just surface-level data. The critical piece: a system connected to broadcast controls for World Cup matches.

FIFA has not publicly confirmed any impact from the vulnerability, nor has the organization detailed what remediation steps it has taken. The identity of the researcher has not been disclosed either.

A broader cyber threat landscape

The internal vulnerability comes against a backdrop of escalating external cyber threats tied to the World Cup. Over 13,000 FIFA-themed domains were registered early in 2026, with a significant portion flagged as malicious or suspicious.

On top of that, there has been a notable increase in fake streaming applications designed to deliver banking malware since the World Cup kicked off. Fans searching for free or unofficial streams are being funneled toward apps that quietly siphon financial credentials.

But external phishing threats are one thing. A vulnerability in FIFA’s own internal systems is a fundamentally different category of risk. External threats target fans and consumers. Internal vulnerabilities threaten the integrity of the event itself.

The more immediate risk is for anyone interacting with World Cup-related digital products over the next month. Fake streaming apps, malicious domains, and phishing campaigns are actively targeting fans. If you’re using any World Cup-connected platform, verify URLs, avoid unofficial apps, and treat any unsolicited link related to the tournament as suspicious until proven otherwise.