PT-2026-22625 · Textream · Textream

Iamcanturk · Published 2026-03-02 · Updated 2026-03-06 · CVE-2026-28403

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Textream versions prior to 1.5.1

Description The application is a macOS teleprompter. A Cross-Site WebSocket Hijacking (CSWSH) condition exists in the DirectorServer WebSocket server (ws://127.0.0.1:<httpPort+1>). The server does not validate the HTTP Origin header during the WebSocket handshake, allowing connections from any origin. A malicious web page, accessed during the same browser session, can connect to the WebSocket server and send arbitrary DirectorCommand payloads, enabling full remote control of the teleprompter content.

Recommendations Update to version 1.5.1 or later.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-28403

GHSA-WR3V-X247-337W

Affected Products

Textream

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28403.json · Exploit
• https://github.com/f/textream/commit/f5ebad82750b9313386c34af8f0ede50c213a8a0 · Patch
• https://github.com/f/textream/security/advisories/GHSA-wr3v-x247-337w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28403 · Security Note
• https://twitter.com/cracbot/status/2029512394821747015 · Twitter Post
• https://twitter.com/cracbot/status/2029874855672525043 · Twitter Post
• https://twitter.com/pulsepatchio/status/2029208624795431406 · Twitter Post