{"id":"CVE-2026-73090","title":"PeerTube is an ActivityPub-federated video streaming platform","summary":"PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the h…","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N","cwe":["CWE-863"],"published":"2026-08-11","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:46:02.457","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73090","references":[{"url":"https://github.com/Chocobozzz/PeerTube/commit/63d487d2a4a2a0e36af8c0ccb888cd23725bf7f2","label":"security-advisories@github.com"},{"url":"https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2","label":"security-advisories@github.com"},{"url":"https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00224,"epssPercentile":0.13266,"ingestedAt":"2026-09-09T21:22:45.528Z","slug":"CVE-2026-73090","body":"## Overview\n\nPeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":51.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}