ActivityPub Update authorization bypass in PeerTube (CVE-2026-73090)

PeerTube's `processUpdateActivity` and `processUpdateVideo` functions accept ActivityPub Update activities containing a Video object without verifying that the signing actor's URL is authorized for the host in the video object's ID. This allows a malicious federated server to overwrite another server's video metadata, visibility, media files, and HLS URLs without being the legitimate video owner. The vendor rates this issue as critical severity. Affected versions: - PeerTube <= 8.2.1 We recommend updating to: 8.2.2. CVSS 9.3 · our assessment: act_now Reference: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2 Details: https://vuln.today/cve/CVE-2026-73090