Cyber ·
CVE-2026-28403 and CVE-2026-28412: local WebSocket server flaws in Textream for macOS
Two issues in the local WebSocket server of Textream, an open-source macOS teleprompter, were fixed in version 1.5.1: missing Origin checks and unlimited connections.
Two issues in Textream, an open-source teleprompter app for macOS, were fixed in version 1.5.1. Both affect its local WebSocket server, called DirectorServer. CVE-2026-28403, rated CVSS 7.6, is a Cross-Site WebSocket Hijacking flaw: the server accepted connections from any origin and did not check the Origin header. The second issue, CVE-2026-28412, involves unlimited connections. According to the advisory, versions before 1.5.1 are affected. The advisory was published on October 20, 2026 on the oss-sec mailing list, with machine translation of the content. To verify, consult the original advisory on the oss-sec list and the project release notes in its public repository, without relying on this summary. Relevance for Rota Nacional: the platform does not patch third-party software and does not act as a firewall for local machines. If your team uses AI tools on macOS workstations alongside apps like this, update Textream to version 1.5.1 and avoid exposing local ports of development services. When studying the advisory with AI help, do not paste names, e-mails, tax IDs, phone numbers or internal system credentials.