FIFA Bug Exposes World Cup Streams to Remote Takeover

Researchers found a Microsoft Entra ID misconfiguration in FIFA's streaming infrastructure that left access controls defined but unenforced, potentially allowing remote attackers to access or manipulate live World Cup broadcast systems (e.g., injecting content, causing regional blackouts, exfiltrating broadcast data). The flaw was responsibly disclosed to FIFA and has been addressed; the report emphasizes common Entra misconfiguration failure modes and recommends testing policy enforcement, inventorying app registrations, and including broadcast/OT in security scope.