Vulnerabilities CVE-2026-73090

CVE-2026-73090

Critical

Open

TLP:CLEAR

PeerTube: Cross-origin remote video takeover via Update activity

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.

Details

CVSS Score: 9.3
EPSS Score ⓘ: 0.22%

13.1th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
Confidence: 90%
Published: Aug 11, 2026
Last Modified: Aug 13, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.