CVE-2026-73090 — PeerTube: Cross-origin remote video takeover via Update activity
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video objec…
Published: 2026-08-11 · CVSS: 9.3 · CVSS 3.1
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7