One of the Paris attackers tried to enter the Stade de France during Friday's friendly between France and Germany but was turned away when his explosive vest was discovered, a security guard and a police officer have told the Wall Street Journal.
The man had a ticket and tried to enter the game about 15 minutes after it had started, but security officers found the device when they frisked him at the gate.
He then detonated the vest while attempting to get away from security officials, according to a guard who was stationed elsewhere in the stadium and briefed on the incident.
A police officer told the Wall Street Journal the attacker had planned to detonate the vest inside the stadium.
The blast was soon followed by a second explosion outside the stadium, with a third happening at a nearby McDonald's.
The newspaper said one civilian had died in the attacks, while French Football Federation president Noel Le Graet earlier told TVInfosport+ that "three people have been killed and several injured after a bomb explosion in front of stadium door number J."
The explosions were part of six coordinated attacks in Paris that left at least 129 people dead, French president Francois Hollande said.
Hollande was attending the game, but was evacuated from the stadium after the first explosion.
The two blasts near the stadium were heard during the match, which was not stopped and continued to its conclusion. France won 2-0.
Supporters were gradually allowed to leave the Stade de France in small groups, although many waited on the pitch as reports of the violence in the city came in.
An announcement over the loudspeakers after the match told people to avoid certain exits "due to events outside.''
At first that prompted some panic, but then the crowds walked slowly to exits. It took an hour and a half to evacuate the stadium after the game.
"We felt safer inside the stadium, but we were getting more and more terrifying news," Arnaud Assoumani, the 2008 Paralympic long jump champion, told L'Equipe's TV channel.
"There was an announcement at the end to say certain gates were open. I feared a crowd surge, which is what happened. Everyone was trying to get out of the doors at the same time.
"Some people were running and they were pushed up against walls and barriers. I don't think there were injuries, but it was a panic surge."
Germany, whose hotel had been subject to a bomb threat on Friday morning, returned to Frankfurt on Saturday after spending the night inside the Stade de France. France's players refused to return to their homes as a show of solidarity with their opponents.
"The French said that they were staying as long as Germany had to stay," said the German Football Association's caretaker president Reinhard Rauball. "That was an outstanding gesture of camaraderie."
Later on Saturday, France midfielder Lassana Diarra revealed that his cousin Asta Diakite died in the attacks.
The Paris tragedy raised concerns about how to protect fans at next summer's European Championship, when 51 matches are scheduled for 10 stadiums around France. The Stade de France will host the opener on June 10 and the final a month later.
"There was already a concern for the Euros, and now it's obviously a lot higher," Le Graet said.
Security officials and organisers now face a huge task to assure the hundreds of thousands of fans planning to come to France next summer that the country is safe.
"We will continue to do everything we can so that security is assured despite all the risks that this entails. I know that everyone is vigilant," Le Graet said. "Obviously this means that we will now be even more vigilant. But it's a permanent concern for the federation and the state.''
With 24 teams involved across the 10 venues, the risks are big. Before Friday's game, 80,000 spectators travelled on trains and then walked several hundred metres to the stadium.
In the months ahead, Le Graet will work closely with Jacques Lambert, the chairman of Euro 2016 SAS, a joint venture between the French and European football federations responsible for all operational aspects of the tournament.
"From the start, we knew security would be a key component in the tournament's success," Lambert said in a recent newspaper interview. "The risk of a terrorist attack against France, I say more against France than against the tournament itself or against UEFA, was outlined from the start. What has really changed is the progression of the terrorist risk in comparison to the other risks."
The French government has ultimate responsibility for overseeing security for Euro 2016, but an agreement was signed in September between the French football federation (FFF) and the Interior Ministry to split up duties.
Stadiums, training camps and team hotels are the responsibility of the tournament organisers, while the state is responsible for assuring the security around those locations. There are also fan zones in which fans without tickets to the games congregate in a central locations to watch matches on giant screens.
Private security firms are responsible for safety inside the stadiums, with police in charge outside, although law enforcement officials also have the authority to enter venues if needed.
Details about more precise security measures, including those pertaining to bag and body searches, will not be revealed until later.
The FFF holds regular security committee meetings with Euro 2016 organisers, with another scheduled to take place on Monday.