Beveiligingsadvies

CVE-2026-28403

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-03-02 15:45:18

Laatst bijgewerkt 2026-03-02 19:27:12

Toegewezen door GitHub_M

CVSS-score 7.6

Status PUBLISHED

Beschrijving

Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server (`ws://127.0.0.1:<httpPort+1>`) accepts connections from any origin without validating the HTTP `Origin` header during the WebSocket handshake. A malicious web page visited in the same browser session can silently connect to the local WebSocket server and send arbitrary `DirectorCommand` payloads, allowing full remote control of the teleprompter content. Version 1.5.1 fixes the issue.

← Alle CVE's bekijken Bekijk op cve.org ↗