How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get someone to pick up the phone.

After registration, I tried navigating to fdp.fifa.org - FIFA’s Football Data Platform. The app authenticated me through the shared Entra tenant, checked my roles, found I had none, and showed me:

“Sorry, you do not have any FIFA Football Data Platform role assigned to your account.”

Looks like it works, right? Access denied. Go away. Nothing to see here.

Except this was all client-side. The Angular app checked the JWT for a NO_ROLES marker and rendered the access-denied page. The backend APIs? They didn’t check anything. They just served whatever you asked for.