Textream before 1.5.1 lacks Origin checks on its local WebSocket server
Original title: CVE-2026-28403, CVE-2026-28412: Textream (macOS) < 1.5.1 local WebSocket server: missing Origin check and unlimited connections
CVE-2026-28403 is rated CVSS 7.6 for cross-site WebSocket hijacking; both issues were fixed in 1.5.1.
Yusuf Can TURK reported two flaws in Textream for macOS, both fixed in version 1.5.1. They affect the local WebSocket server named DirectorServer. CVE-2026-28403 is cross-site WebSocket hijacking: the server accepted connections from any origin and did not check Origin. CVE-2026-28412 concerns unlimited connections; the posted text is cut off.
Unconfirmed: The post is truncated before it fully describes CVE-2026-28412.
- Both flaws affect DirectorServer, Textream's local WebSocket server.
- CVE-2026-28403 has a stated CVSS score of 7.6.
- The reporter says the issues were fixed in version 1.5.1.
Impact: Any origin can connect to the local WebSocket server
| Product | Affected | Fixed in |
|---|---|---|
| Textream | macOS before 1.5.1 | 1.5.1 |
- 1.Update Textream on macOS to version 1.5.1.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-28403+1 related CVE | Textream: The `DirectorServer` WebSocket server (`ws://127.0.0.1: `) accepts connections from any origin without validating the HTTP… | 7.6 group max | <1% | PoC |
From the original article
Posted by Yusuf Can TURK on Oct 20 Hello, https://github. com/f/textream https://www. google.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.