CVE-2026-73090

Received Received - Intake

ActivityPub Update Activity Spoofing in PeerTube

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73090

EUVD

EUVD-2026-56784

Affected Vendors & Products

Vendor	Product	Version / Range
peertube	peertube	8.2.2
chocobozzz	peertube	to 8.2.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-73090 is a critical vulnerability in PeerTube's ActivityPub federation handling. It allows a malicious federated server to rewrite another server's video metadata, visibility, media files, and HLS URLs without authorization. The issue occurs because PeerTube versions prior to 8.2.2 do not verify that the actor's URL is authorized for the video's host during Update activities.

Detection Guidance

Check PeerTube server logs for unauthorized Update activity messages or video metadata changes. Monitor for unexpected video URL or host modifications in processUpdateVideo and processUpdateActivity functions. Verify server version is 8.2.2 or later to confirm patch status.

Impact Analysis

Attackers can impersonate legitimate video updates to deface videos by altering titles, descriptions, or visibility settings. They can also replace video files or streaming URLs with malicious content, potentially distributing harmful media to users. Since PeerTube is federated, this could affect multiple instances across the network.

Compliance Impact

This vulnerability could lead to unauthorized modification of video metadata, media files, or streaming URLs, potentially exposing sensitive data or violating data integrity. For GDPR, this may impact compliance with principles like integrity and confidentiality (Article 5) and data breach notification requirements (Article 33). For HIPAA, unauthorized changes to video content could compromise protected health information integrity or availability.

Mitigation Strategies

Upgrade PeerTube to version 8.2.2 or later immediately. Review federated video updates for unauthorized changes. Monitor network traffic for suspicious ActivityPub Update messages targeting PeerTube instances.

Hi! I’m here to help you understand CVE-2026-73090. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70