Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server (`ws://127.0.0.1:<httpPort+1>`) accepts connections fro…

Published:

1 maart 2026 om 23:00:00

Alert date:

2 maart 2026 om 17:01:35

Source:

nvd.nist.gov

Operating Systems, Web Technologies

CVE-2026-28403 affects Textream, a free macOS teleprompter app. Prior to version 1.5.1, the DirectorServer WebSocket server accepts connections from any origin without validating the HTTP Origin header during the WebSocket handshake. This allows malicious web pages visited in the same browser session to silently connect to the local WebSocket server and send arbitrary DirectorCommand payloads, enabling full remote control of the teleprompter content. The vulnerability was fixed in version 1.5.1.

Technical details

Mitigation steps:

Affected products:

Textream