CVE-2026-73090

The 9.3 CVSS score for CVE-2026-73090 badly undersells the actual risk. This isn't a simple code flaw — it's a systemic failure where ActivityPub's protocol design and PeerTube's implementation diverged on a fundamental security boundary. The protocol verifies that an Update activity originated from a federated peer (cryptographic signature validation), but PeerTube did not verify that the sending actor actually had authority to modify the object in question. That's an authorization check, not an authentication one, and the distinction is the entire vulnerability. A compromised or malicious federated peer — or even one that joined your federation graph specifically to exploit it — could send Update activities that your instance would accept and propagate because the signatures were valid. Video visibility changes could expose private or internal content. Modified HLS stream URLs could redirect media playback to attacker-controlled infrastructure, creating client-side compromise that persists independent of your server state. Once downstream instances receive and persist these poisoned updates, they become authoritative sources that faithfully redistribute the contaminated data to their own peers. The 8.2.2 patch adds byActor.url domain verification, which correctly closes the authorization gap going forward. But this creates two urgent operational problems. First, there's no mechanism for a patched instance to request authoritative correction from peers or announce that its state was contaminated. The fix stops new attacks but doesn't heal existing damage. Second, because the malicious updates are cryptographically valid, there's no in-band signal distinguishing poisoned state from legitimate modification — you cannot detect the contamination from within your own system. For operators: audit federated objects received during the unpatched window if you can, but recognize that small instances without forensic capability are effectively permanent contamination vectors. The real blast radius isn't your attack surface — it's the downstream contamination graph that extends through every federation edge your peers touched during the vulnerable window, with no natural correction signal and no rollback mechanism. The vulnerability is patched; the poisoned state may already be irreversible.

Reviewed through automated stages and approved by a human before publication.