His real ID unlocked stream keys for every World Cup camera (bobdahacker.com)
The flaw was textbook: roles were checked client-side only. The server never validated the JWT, so the APIs served live broadcast infrastructure to anyone who registered on FIFA's public Agent Platform. Push to the RTMP endpoint and you replace the feed on TV worldwide.
The twist: FIFA never responded. No acknowledgment, no thank-you, no bounty — they just silently patched it. Half the thread asked why he reported it at all.
Sign in to save