# Security research

> When I find a vulnerability in software I use, I tell the vendor. Once a fix ships, I publish it here.

URL: https://iamcanturk.dev/en/security/

---

### CVE-2026-28403 — Missing WebSocket origin validation (Cross-Site WebSocket Hijacking)
CVSS 7.6 (HIGH) · Textream (macOS) < 1.5.1 · March 2026
Textream's local WebSocket server did not validate the Origin header. A malicious web page visited by the user could silently connect to it and send commands.

### CVE-2026-28412 — Resource exhaustion through unlimited connections (DoS)
CVSS 6.5 (MEDIUM) · Textream (macOS) < 1.5.1 · March 2026
Textream's WebSocket server imposed no limit on concurrent connections. Flooding it exhausted CPU and memory and could freeze the app during a live session.

## How I work

- **Finding:** I review software I use myself. When I find a flaw I confirm it with a proof of concept, without touching anyone's data.

- **Report:** I notify the vendor privately, with reproduction steps.

- **Fix:** I don't share details until a patch is released.

- **Publish:** After the fix ships, the CVE record and the summary here go public.