# CVE-2026-28403: Missing WebSocket origin validation (Cross-Site WebSocket Hijacking)

> Textream's local WebSocket server did not validate the Origin header. A malicious web page visited by the user could silently connect to it and send commands.

URL: https://iamcanturk.dev/en/security/cve-2026-28403/
CVSS 7.6 (HIGH) · Textream (macOS) < 1.5.1 · March 2026

---

## Summary

In Textream for macOS prior to 1.5.1, the `DirectorServer` WebSocket server accepted connections from any origin without validating the HTTP `Origin` header during the handshake.

## Impact

A malicious web page visited in the same browser session could silently connect to the local WebSocket server and send arbitrary commands.

## Fix

Update to **1.5.1 or later**. If you write your own WebSocket server, compare the `Origin` header against an allowlist during the handshake and reject anything that doesn't match.

References:
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-28403
- GitHub Security Advisory: https://github.com/f/textream/security/advisories/GHSA-wr3v-x247-337w
- Fix commit: https://github.com/f/textream/commit/f5ebad82750b9313386c34af8f0ede50c213a8a0
- CVE record (MITRE): https://www.cve.org/CVERecord?id=CVE-2026-28403
- CVE record (Feedly): https://feedly.com/cve/CVE-2026-28403