by Kastro
Paper/Archive/CVE-2026-73090

CVE-2026-73090

Chocobozzz PeerTube — PeerTube: Cross-origin remote video takeover via Update activity

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
35
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 33.7.337 × 206.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.

Affected

ProductAffectedFixed inSource
PeerTube< 8.2.2–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86refgithub.com/Chocobozzz/PeerTube/commit/63d487d2a4a2a0e36af8c0ccb888cd23725bf7f2refgithub.com/Chocobozzz/PeerTube/releases/tag/v8.2.2