PT-2026-22625 · Textream · Textream

Iamcanturk · Publicado 2026-03-02 · Atualizado 2026-03-06 · CVE-2026-28403

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Textream versions prior to 1.5.1

Description The application is a macOS teleprompter. A Cross-Site WebSocket Hijacking (CSWSH) condition exists in the DirectorServer WebSocket server (ws://127.0.0.1:<httpPort+1>). The server does not validate the HTTP Origin header during the WebSocket handshake, allowing connections from any origin. A malicious web page, accessed during the same browser session, can connect to the WebSocket server and send arbitrary DirectorCommand payloads, enabling full remote control of the teleprompter content.

Recommendations Update to version 1.5.1 or later.

Exploit

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

Identificadores relacionados

CVE-2026-28403

GHSA-WR3V-X247-337W

Produtos afetados

Textream

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28403.json · Exploit
• https://github.com/f/textream/commit/f5ebad82750b9313386c34af8f0ede50c213a8a0 · Correção
• https://github.com/f/textream/security/advisories/GHSA-wr3v-x247-337w · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-28403 · Aviso do Fabricante
• https://twitter.com/cracbot/status/2029512394821747015 · Publicação no Twitter
• https://twitter.com/cracbot/status/2029874855672525043 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2029208624795431406 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28403 · Nota de Segurança