CVE-2026-28403, CVE-2026-28412: Textream (macOS) < 1.5.1 local WebSocket server: missing Origin check and unlimited connections

As cited

Copy frozen at 2026-10-20 23:56 UTC (site build).

vulnerabilities

CVE-2026-28403, CVE-2026-28412: Textream (macOS) < 1.5.1 local WebSocket server: missing Origin check and unlimited connections

Textream, an open-source macOS teleprompter application, addressed two WebSocket server vulnerabilities in version 1.5.1. CVE-2026-28403 (CVSS 7.6) involves cross-site WebSocket hijacking due to missing origin validation, and CVE-2026-28412 addresses unlimited connection handling in the DirectorServer component.

Why it matters: macOS users running Textream below version 1.5.1 face potential hijacking of local WebSocket connections; update to 1.5.1 or later immediately.

Source published

2026-10-20 21:43 UTC

First seen by Cybersecurity Tracker

2026-10-20 23:13 UTC