CVE-2026-73090: PeerTube Auth Bypass Vulnerability

CVE-2026-73090 Overview

CVE-2026-73090 is a critical authorization vulnerability in PeerTube, an ActivityPub-federated video streaming platform. Versions prior to 8.2.2 fail to verify that an ActivityPub Update activity originates from an actor authorized for the target video's host. The processUpdateActivity and processUpdateVideo functions accept a Video object without confirming that byActor.url matches the host in videoObject.id. A malicious federated server can rewrite another server's video metadata, visibility settings, media file, and HTTP Live Streaming (HLS) URLs. The issue is fixed in PeerTube version 8.2.2 and is classified under CWE-863: Incorrect Authorization.

Critical Impact
Any federated PeerTube instance can silently overwrite another instance's video content, redirect viewers to attacker-controlled media, and manipulate video visibility across the federation.

Affected Products

PeerTube versions prior to 8.2.2
PeerTube instances participating in ActivityPub federation
Downstream deployments consuming federated Video objects

Discovery Timeline

2026-08-11 - CVE-2026-73090 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-73090

Vulnerability Analysis

PeerTube uses ActivityPub to federate video content across independent instances. When a remote server issues an Update activity for a Video object, the receiving server processes the update through processUpdateActivity and processUpdateVideo. These handlers extract the actor performing the update (byActor) and the target video object (videoObject), but do not enforce that both entities reside on the same host.

The missing host comparison allows a federated peer to send an Update activity for a Video whose id URL points to a completely different origin server. The receiving instance applies the mutation as if it were legitimate, replacing metadata, media file URLs, HLS playlist URLs, and visibility flags. Viewers on the affected instance are then served attacker-controlled content.

Root Cause

The root cause is an authorization check omission [CWE-863]. Neither processUpdateActivity nor processUpdateVideo invoked a same-host verification between the update actor and the video object's canonical URL before persisting changes.

Attack Vector

Exploitation requires no authentication beyond operating a federated ActivityPub server. An attacker stands up a PeerTube-compatible instance, initiates federation with a target, and dispatches a crafted Update activity referencing a video hosted on a third-party server. The receiving instance rewrites its local record for that video.

typescript

// Patch: server/core/lib/activitypub/process/process-update.ts
 import { createOrUpdateVideoPlaylist } from '../playlists/index.js'
 import { forwardVideoRelatedActivity } from '../send/shared/send-utils.js'
 import { APVideoUpdater, canVideoBeFederated, getOrCreateAPVideo, maybeGetOrCreateAPVideo } from '../videos/index.js'
+import { checkUrlsSameHost } from '../url.js'
 
 async function processUpdateActivity (options: APProcessorOptions<ActivityUpdate<ActivityUpdateObject>>) {
   const { activity, byActor } = options

Source: PeerTube commit 63d487d

The fix imports checkUrlsSameHost and enforces host equality before applying video updates. A companion change in refresh.ts propagates the authoritative video.url into the APVideoUpdater constructor:

typescript

// Patch: server/core/lib/activitypub/videos/refresh.ts
-    const videoUpdater = new APVideoUpdater(videoObject, video)
+    const videoUpdater = new APVideoUpdater(videoObject, video, video.url)
     await videoUpdater.update()

Source: PeerTube commit 63d487d

Detection Methods for CVE-2026-73090

Indicators of Compromise

Inbound ActivityPub Update activities where the signing actor's host does not match the host in the Video object id field.
Unexpected changes to video fileUrl, HLS playlist URLs, or privacy fields in the PeerTube database without local user action.
Federation logs showing Update events for videos not owned by the sending instance.

Detection Strategies

Audit database change logs for the video and videoStreamingPlaylist tables and correlate updates against the origin host of the requesting actor.
Parse PeerTube application logs for processUpdateActivity and processUpdateVideo invocations that reference cross-host videoObject.id values.
Compare current video media URLs against previously federated snapshots to identify silent rewrites.

Monitoring Recommendations

Alert on outbound HLS or media requests to hosts not previously associated with a given video's origin instance.
Monitor federation peers for anomalous volumes of Update activities targeting external video identifiers.
Track PeerTube version strings across your federation graph to flag unpatched peers accepting malicious updates.

How to Mitigate CVE-2026-73090

Immediate Actions Required

Upgrade all PeerTube instances to version 8.2.2 or later without delay.
Review recent Update activities in federation logs to identify potentially rewritten videos.
Restore altered video metadata and media URLs from backups where tampering is confirmed.

Patch Information

The vulnerability is fixed in PeerTube v8.2.2. Technical details are documented in GHSA-g9p4-f7h8-hc86 and the remediation commit. The fix introduces checkUrlsSameHost enforcement inside processUpdateActivity and processUpdateVideo.

Workarounds

Temporarily restrict federation to a trusted allowlist of PeerTube instances until the upgrade to 8.2.2 completes.
Disable the acceptance of remote Update activities at the reverse proxy layer if immediate patching is not feasible.
Increase logging verbosity on the ActivityPub inbox endpoint to capture actor and object URLs for forensic review.

bash

# Upgrade PeerTube to the patched release
cd /var/www/peertube
sudo -u peertube git fetch origin
sudo -u peertube git checkout v8.2.2
sudo -u peertube yarn install --production --pure-lockfile
sudo systemctl restart peertube