EUVD-2026-56784Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
Remote unauthenticated federated peer (AV:N/PR:N) with low complexity rewrites content on another server (S:C, I:H); forced visibility change yields C:L, no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.
AnalysisAI
Federation-based metadata takeover in PeerTube before 8.2.2 lets a malicious remote ActivityPub server rewrite videos it does not own on a victim instance. Because processUpdateActivity/processUpdateVideo never verify that the signing actor's host matches the host in the target video's id (videoObject.id), any federated peer can push an Update that overwrites another server's video title, description, visibility, stored media file, and HLS playlist URLs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to operate a federated ActivityPub server whose Update activities the victim instance processes, and to send an Update carrying a Video object whose id references the victim host while being signed by an actor from a different (attacker) host - the exact gap the checkUrlsSameHost fix closes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent and point to a genuine, high-priority integrity issue rather than an inflated CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker stands up (or compromises) an ActivityPub server that federates with a target PeerTube instance and crafts an Update activity signed by their own actor but referencing a Video object whose id belongs to the victim's host. The vulnerable server applies the update without checking host authority, letting the attacker swap the video's media file and HLS URLs to attacker-controlled content or flip a private video to public. … |
| Remediation | Upgrade to PeerTube 8.2.2, which adds the missing same-host authorization check (Vendor-released patch: v8.2.2); see the advisory GHSA-g9p4-f7h8-hc86 and release notes at https://github.com/Chocobozzz/PeerTube/releases/tag/v8.2.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all PeerTube deployments and document current versions to identify exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today