CYBER CODE RED

Get real-time updates on Telegram

VULNERABILITYOpen Source SecurityP5

CVE-2026-28403, CVE-2026-28412: Textream (macOS) < 1.5.1 local WebSocket server: missing Origin check and unlimited connections

Posted by Yusuf Can TURK on Oct 20 Hello, Two issues in Textream, an open-source macOS teleprompter app (https://github.com/f/textream ), were fixed in version 1.5.1. Both affect its local WebSocket server ("DirectorServer"). CVE-2026-28403 (CVSS 7.6): Cross-Site WebSocket Hijacking. The server accepted connections from any origin and did not check the...

Published 21-Oct-2026 04:28 UTC · First seen 21-Oct-2026 04:27 UTC

Sources