CVE-2026-28403 Details
Description
Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server (`ws://127.0.0.1:<httpPort+1>`) accepts connections from any origin without validating the HTTP `Origin` header during the WebSocket handshake. A malicious web page visited in the same browser session can silently connect to the local WebSocket server and send arbitrary `DirectorCommand` payloads, allowing full remote control of the teleprompter content. Version 1.5.1 fixes the issue.
A Cross-Site WebSocket Hijacking vulnerability has been identified in Textream, a free macOS teleprompter application, prior to version 1.5.1. The issue arises in the `DirectorServer` WebSocket server, which accepts connections from any origin without validating the HTTP `Origin` header during the WebSocket handshake. This vulnerability allows a malicious web page, visited in the same browser session, to silently connect to the local WebSocket server and send arbitrary `DirectorCommand` payloads. As a result, the teleprompter content can be fully controlled remotely. Version 1.5.1 addresses this vulnerability.
Users are advised to update to Textream version 1.5.1 or later, which includes a fix for this vulnerability by adding origin validation and authentication tokens for WebSocket connections.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/f/textream/commit/f5ebad82750b9313386c34af8f0ede50c213a8a0 | [email protected] | Patch |
| https://github.com/f/textream/security/advisories/GHSA-wr3v-x247-337w | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fka textream | < 1.5.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | Reanalysis | [email protected] |
| Mar 4, 2026 | Initial Analysis | [email protected] |
| Mar 2, 2026 | New CVE Received | [email protected] |