Summary
CVE-2026-73090 is a critical incorrect-authorization vulnerability (CWE-863) in PeerTube, an ActivityPub-federated video streaming platform. Versions prior to 8.2.2 fail to verify that the actor sending an ActivityPub Update activity is authorized for the host that owns the referenced video, allowing any malicious federated server to rewrite another server’s video metadata, visibility, media file, and HLS streaming URLs. The flaw carries a CVSS v3.1 base score of 9.3 (Critical) and requires no authentication or user interaction.
Technical details
- Root cause:
processUpdateActivityandprocessUpdateVideoaccept an ActivityPubUpdateactivity containing aVideoobject without checking thatbyActor.urlis authorized for the host referenced invideoObject.id. - Trigger condition: A remote/federated PeerTube (or attacker-controlled ActivityPub) server sends a properly signed
Updateactivity referencing a video hosted on a different, victim instance. - Attack vector: Network, via the federation/inbox endpoint used for ActivityPub message exchange between instances — no authentication or user interaction required.
- Impact: Attacker can alter video titles, descriptions, and visibility settings, and replace media file/HLS streaming URLs with attacker-controlled content, exposing viewers on the victim instance to malicious or malicious-redirect content. Confidentiality impact is low; integrity impact is high; availability is unaffected.
Affected software
- PeerTube versions prior to 8.2.2
Severity
- CVSS v3.1 Base Score: 9.3 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
Mitigation and recommended actions
- Immediate: Upgrade PeerTube to version 8.2.2 or later, which enforces authorization checks on incoming ActivityPub
Updateactivities. - If immediate patching is not possible: Restrict or closely monitor federation with untrusted or unknown PeerTube instances, and review video metadata/visibility on federated content for unexpected changes until the patch can be applied.

