Textream WebSocket Server Lacks Origin Check, Exposes Local Data

The open-source macOS teleprompter application Textream contains two vulnerabilities in its local WebSocket server component, known as DirectorServer. According to an advisory posted by Yusuf Can TURK on October 20, these flaws were addressed in version 1.5.1. The primary issue involves a failure to validate the Origin header of incoming WebSocket connections. This oversight allows any web page loaded on the same machine to initiate communication with the local server, potentially exposing sensitive teleprompter data or control functions to malicious scripts running in the user's browser.

Root cause

The DirectorServer component in Textream was configured to accept WebSocket connections from any origin without performing necessary security checks. This architectural decision meant that the server could not distinguish between legitimate local requests and those initiated by potentially malicious web content. Additionally, the server lacked limits on the number of concurrent connections it would accept. This combination of missing origin validation and unlimited connection capacity creates a vulnerable surface where local web applications can interact with the teleprompter service without restriction.

Attack path

An attacker would need to persuade a user to visit a malicious website while Textream is running on their macOS device. Once the user loads the page, JavaScript code embedded in the site could attempt to open a WebSocket connection to the local DirectorServer. Because the server does not verify the Origin header, it accepts the connection from the external web page. This allows the attacker to read data transmitted by the teleprompter or send commands to control it, effectively hijacking the local service through the user's browser session.

Affected versions

• Textream versions prior to 1.5.1 are affected by CVE-2026-28403 and CVE-2026-28412.
• Version 1.5.1 includes the fixes for both the missing origin check and the unlimited connection issue.

Mitigation

• Update Textream to version 1.5.1 or later to apply the vendor's security fixes.
• Avoid visiting untrusted websites while running the vulnerable version of the application.
• Monitor local network traffic for unexpected WebSocket connections to the DirectorServer port.

Detection notes

Security teams should monitor for unusual WebSocket connections originating from web browsers to local services. Look for connections to known local ports that lack proper origin headers or come from unexpected domains. Network logs may show repeated connection attempts from web pages to local application servers. Check for high volumes of data transfer between the browser and the local teleprompter service. If suspicious activity is detected, isolate the affected machine from the network to prevent further exploitation. Review browser extensions and installed scripts that might facilitate unauthorized local connections.

What to do and how to stay safe: Textream

• Verify the installed version of Textream and update to 1.5.1 if you are running an older release.
• Inspect local network logs for WebSocket connections to the DirectorServer port from unexpected sources.
• Educate users about the risks of visiting untrusted websites while local development or utility servers are running.
• Once the vendor provides an update, ensure automatic updates are enabled to receive future security patches promptly.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-28403?

CVE-2026-28403 is a Cross-Site WebSocket Hijacking vulnerability in Textream's DirectorServer that occurs because the server accepts connections from any origin without checking the Origin header.

Which versions of Textream are vulnerable?

All versions of Textream prior to 1.5.1 are affected by this vulnerability and the associated unlimited connection issue.

Is there a fix available?

Yes, the vulnerabilities were fixed in version 1.5.1 of the Textream application.