CVE-2026-28403 Overview
CVE-2026-28403 affects Textream, a free macOS teleprompter application. The flaw exists in the DirectorServer WebSocket server bound to ws://127.0.0.1:<httpPort+1>. The server accepts connections from any origin without validating the HTTP Origin header during the WebSocket handshake. A malicious web page visited in the same browser session can silently connect to the local WebSocket server. The attacker can then send arbitrary DirectorCommand payloads and gain full remote control of the teleprompter content. The issue is classified as [CWE-346] Origin Validation Error. Version 1.5.1 of Textream resolves the vulnerability.
Critical Impact
A user visiting a malicious web page while Textream runs locally allows attackers to silently hijack teleprompter content through the unvalidated local WebSocket interface.
Affected Products
- Textream for macOS versions prior to 1.5.1
- Textream DirectorServer WebSocket component
- Local WebSocket endpoint at ws://127.0.0.1:<httpPort+1>
Discovery Timeline
- 2026-03-02 - CVE-2026-28403 published to NVD
- 2026-03-10 - Last updated in NVD database
Technical Details for CVE-2026-28403
Vulnerability Analysis
The vulnerability stems from missing origin validation in the Textream DirectorServer WebSocket handshake. The server listens locally on 127.0.0.1 at a port one above the configured HTTP port. WebSocket connections initiated from browsers include an Origin header that servers must validate to prevent cross-origin abuse. The DirectorServer accepts the handshake regardless of the Origin value. Any web page loaded in a browser on the same machine can establish a WebSocket connection to the local server. Once connected, the attacker's JavaScript transmits DirectorCommand payloads that the server processes as authorized operator input.
Root Cause
The root cause is an Origin Validation Error in the WebSocket server implementation. Browsers enforce the same-origin policy for HTTP responses but allow cross-origin WebSocket connections by default. Servers must explicitly check the Origin header to refuse unauthorized callers. Textream prior to 1.5.1 omits this check, treating any handshake as legitimate.
Attack Vector
Exploitation requires user interaction. The victim must run Textream on macOS and visit an attacker-controlled web page in the same browser session. The page loads JavaScript that opens a WebSocket to ws://127.0.0.1:<httpPort+1>. After the handshake completes, the script sends crafted DirectorCommand messages. The attacker controls displayed teleprompter text, scroll position, and other director-level functions. This can substitute scripted content during live broadcasts, recordings, or presentations.
No verified proof-of-concept code has been published. The fix is committed in GitHub Commit f5ebad8 and documented in the GitHub Security Advisory GHSA-wr3v-x247-337w.
Detection Methods for CVE-2026-28403
Indicators of Compromise
- Unexpected WebSocket connections to 127.0.0.1 on the Textream httpPort+1 port from browser processes
- Teleprompter content changes that do not match operator input during live use
- Browser network logs showing Upgrade: websocket requests to local loopback addresses originating from unrelated web origins
Detection Strategies
- Monitor macOS process telemetry for browser children initiating loopback WebSocket sessions while Textream runs
- Inspect Textream application logs for DirectorCommand messages received outside expected operator workflows
- Use endpoint detection tooling to flag local loopback connections between browser binaries and the Textream process
Monitoring Recommendations
- Track installed Textream versions across managed macOS endpoints and alert on versions below 1.5.1
- Log outbound browser network activity and correlate with concurrent Textream process execution
- Review web proxy logs for visits to untrusted domains during recorded teleprompter sessions
How to Mitigate CVE-2026-28403
Immediate Actions Required
- Upgrade Textream to version 1.5.1 or later on all macOS systems where it is installed
- Restrict browser activity on hosts running Textream during live production sessions
- Audit current Textream installations and remove unsupported versions from managed fleets
Patch Information
Textream 1.5.1 introduces Origin header validation in the DirectorServer WebSocket handshake. The fix is published in GitHub Commit f5ebad8. Full advisory details are available in the GitHub Security Advisory GHSA-wr3v-x247-337w. Apply the update through the standard Textream distribution channel.
Workarounds
- Avoid browsing untrusted websites while Textream is running on the same macOS host
- Use a dedicated browser profile or separate user session for teleprompter operations
- Block outbound browser connections to the Textream local WebSocket port using host-based firewall rules until patched
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.