CVE-2026-73090 in PeerTube
Summary
by MITRE • 08/11/2026
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability identified in PeerTube versions prior to 8.2.2 represents a critical authorization bypass flaw that undermines the integrity of the federated video streaming platform's core functionality. This security weakness exists within the ActivityPub implementation where the platform fails to validate the authenticity of federated updates before processing them. The specific functions processUpdateActivity and processUpdateVideo are designed to handle incoming ActivityPub Update messages containing Video objects, but they lack proper validation mechanisms to verify that the originating server has authorization rights over the target video content.
The technical flaw stems from insufficient verification of the byActor.url parameter within the ActivityPub Update message structure. When a malicious federated server sends an update request, the system accepts the video object without confirming that the URL specified in byActor.url corresponds to an authorized host capable of modifying the video identified by videoObject.id. This validation gap allows threat actors to manipulate metadata, visibility settings, media file references, and HLS streaming URLs of videos hosted on legitimate PeerTube instances. The vulnerability creates a scenario where unauthorized entities can effectively hijack and modify content across federated networks without proper authentication or authorization.
The operational impact of this vulnerability extends beyond simple data manipulation to potentially compromise the entire federated ecosystem. Attackers could use this flaw to distribute malicious content, alter video visibility settings from private to public, redirect users to compromised streaming endpoints, or modify metadata to misrepresent content sources. The implications become particularly severe in environments where PeerTube instances serve sensitive or copyrighted material, as unauthorized modifications could lead to content tampering, intellectual property violations, or the dissemination of false information across connected platforms. This vulnerability directly violates fundamental security principles of access control and data integrity within federated systems.
The fix implemented in version 8.2.2 addresses this issue by introducing proper authorization validation before processing federated update requests. The updated implementation ensures that each ActivityPub Update message contains a valid byActor.url that corresponds to an authorized host for the target video object, preventing unauthorized modifications across federated networks. This remediation aligns with established security practices outlined in CWE-284 Access Control and follows ATT&CK techniques related to privilege escalation and command and control through federated network manipulation. Organizations should immediately upgrade to version 8.2.2 or later to mitigate this risk, while also implementing additional monitoring of federated update activities to detect potential exploitation attempts before they can cause significant damage to their video content integrity and user trust within the PeerTube ecosystem.