Description

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-11T18:18:26.210Z",
  "pubdate": "2026-08-11T18:18:26.210Z",
  "executiveSummary": "PeerTube prior to version 8.2.2 contains an authorization bypass vulnerability within its ActivityPub federation processing engine, specifically affecting video and activity update handlers. The vulnerability allows a malicious federated server to spoof and manipulate critical metadata, visibility settings, media files, and HLS streaming URLs belonging to videos hosted on entirely separate, legitimate PeerTube instances. This security flaw stems from an insufficient validation mechanism when processing incoming ActivityPub updates, failing to properly verify whether the originating actor is authorized to modify resources associated with a different host domain. The risk implications are severe, as untrusted federated peers can effectively deface, hijack, or corrupt foreign video content across the decentralized network without requiring authentication or prior privileges on the target instance. Exploitation is entirely network-based, relying on the federation layer where malicious servers transmit crafted ActivityPub Update payloads targeting foreign video object identifiers. Remediation requires upgrading PeerTube to version 8.2.2 or later, where strict origin validation checks are enforced.",
  "technicalDetails": "The vulnerability resides in the PeerTube federation subsystem, specifically within the processUpdateActivity and processUpdateVideo functions responsible for handling incoming ActivityPub protocol messages. The root cause of the vulnerability is an insufficient validation flaw wherein the application processes an incoming ActivityPub Update payload containing a Video object without cryptographically or logically verifying that the byActor.url property matches or is explicitly authorized for the host domain specified within the target videoObject.id. In a secure decentralized federation architecture, an actor belonging to a specific origin server must only be permitted to modify resources residing within that same administrative boundary or domain namespace. Because PeerTube failed to enforce this origin-to-actor authorization check prior to version 8.2.2, a malicious federated server can successfully inject arbitrary modifications into the database or state of a victim instance.\nThe exploitation method relies on the public network exposure of the ActivityPub federation endpoint. An attacker operating a malicious or compromised federated server crafts a malicious ActivityPub Update payload referencing a video object ID hosted on a target PeerTube instance. The payload includes manipulated fields designed to alter the victim video's metadata, visibility parameters, underlying media files, and HTTP Live Streaming (HLS) playlist URLs. When the target PeerTube instance receives this federation message, the vulnerable processUpdateActivity and processUpdateVideo functions parse the incoming object. Because the software fails to validate whether the actor submitting the update holds legitimate authority over the target video's host domain, the application accepts the update as authentic.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies a target video on a remote PeerTube instance via its unique videoObject.id. Second, the attacker constructs an ActivityPub Update activity where the object property encapsulates the modified Video attributes while setting the actor field to the attacker's controlled identity. Third, the attacker transmits this federation payload over the network to the target PeerTube instance's inbox endpoint. Fourth, the target instance processes the update via the vulnerable functions, bypassing host authorization checks. Finally, the local database and file references are updated with the attacker-supplied values, leading to unauthorized content rewriting, potential redirection of HLS streams to malicious media sources, or complete visibility modification of the affected video. Post-exploitation impact includes content integrity loss, denial of service via stream redirection, and reputational damage to the affected platform instance."
}