An unauthenticated SQL injection in PeerTube allows remote attackers to compromise administrative accounts and read or modify sensitive database tables.

The flaw resides in the ActorFollowModel.updateScore() function, where attacker-controlled input is improperly interpolated into an SQL query. This allows unauthenticated actors to perform unauthorized database operations, including the theft of OAuth access tokens.

The potential for administrative account takeover via SQL injection makes this a critical vulnerability. With a CVSS score of 9.8, the impact includes total loss of control over the video platform, potential exfiltration of sensitive user data, and the ability to manipulate platform content or settings.

Immediate Action: Update PeerTube to version 8.1.6 or later to include the fix for the SQL injection vulnerability.

Proactive Monitoring: Audit database access logs for unauthorized queries or unusual activity related to the ActorFollowModel or OAuth token tables.

Compensating Controls: Implement strict network-level egress filtering for federated services and utilize a WAF to inspect incoming ActivityPub payloads for malicious SQL patterns.

Public Exploit Available: No (unknown).

This vulnerability poses an extreme risk to the security and integrity of PeerTube instances. Administrators are urged to apply the 8.1.6 update immediately to prevent unauthorized administrative access and protect platform data.