The vulnerability in PeerTube allows a malicious federated server to send an ActivityPub Update containing a Video object that bypasses verification of the actor URL against the host in the video object ID. This is a CWE-863: Missing Authorization Checks vulnerability, enabling the attacker to overwrite another server’s video metadata, adjust visibility, replace the media file, and modify HLS URLs, effectively taking over and altering the video as if the original creator changed it.

PeerTube deployments by Chocobozzz, versions prior to 8.2.2. The issue exists in all releases before the 8.2.2 update.

The CVSS score of 9.3 indicates critical severity. An EPSS score of <1% suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation can be achieved by any federated server that can send arbitrary Update activities, making the attack technically feasible in federated environments where actors are not strictly validated.