CVE-2026-73090

creationtimestamp| type| source ---|---|--- 2026-08-11 20:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mstgt67nwl2q...

CVE-2026-73090 PeerTube: Cross-origin remote video takeover via Update activity

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server...