CVE-2026-28403
Textream is a free macOS teleprompter app.
Published Mar 2, 2026 · updated Jun 17, 2026 · fka textream
Textream is a free macOS teleprompter app. Prior to version 1.5.1, the WebSocket server ( ) accepts connections from any origin without validating the HTTP header during the WebSocket handshake. A malicious web page visited in the same browser session can silently connect to the local WebSocket server and send arbitrary payloads, allowing full remote control of the teleprompter content. Version 1.5.1 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 2, 2026 · NIST NVD
Detected
Textream is a free macOS teleprompter app. Prior to version 1.5.1, the WebSocket server ( ) accepts connections from any origin without validating the HTTP header during the WebSocket handshake. A malicious web page visited in the same browser session can silently connect to the local WebSocket server and send arbitrary payloads, allowing full remote control of the teleprompter content. Version 1.
Jun 17, 2026 · NIST NVD
Updated
Textream is a free macOS teleprompter app. Prior to version 1.5.1, the WebSocket server ( ) accepts connections from any origin without validating the HTTP header during the WebSocket handshake. A malicious web page visited in the same browser session can silently connect to the local WebSocket server and send arbitrary payloads, allowing full remote control of the teleprompter content. Version 1.
Affected
- cpe fka/textreamversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-28403
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-28403
Textream is a free macOS teleprompter app. Prior to version 1.5.1, the WebSocket server ( ) accepts connections from any origin without validating the HTTP header during the WebSocket handshake. A malicious web page visited in
nvd.nist.gov