CVE-2026-73090: PeerTube: Cross-origin remote video takeover via Update activity
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PeerTubeto a version that resolves this vulnerability.Fixed in 8.2.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73090?
CVE-2026-73090 has a critical severity score of 9.3.
How do I fix CVE-2026-73090?
To fix CVE-2026-73090, upgrade your PeerTube installation to version 8.2.2 or later.
What kind of vulnerability is CVE-2026-73090?
CVE-2026-73090 is a cross-origin remote video takeover vulnerability.
Can CVE-2026-73090 be exploited remotely?
Yes, CVE-2026-73090 can be exploited remotely due to its nature as a cross-origin vulnerability.
What impact does CVE-2026-73090 have on video streaming?
Exploitation of CVE-2026-73090 could allow unauthorized video updates and potentially compromise user data.