Executive brief
Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication
Affected products
- Go github.com/xyproto/algernon
Junglewise Threat Intelligence
Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication
Severity: low · CVSS 3.1 · Published 2026-05-19
Technologies: github.com/xyproto/algernon (Go). Vendors: Go.
Related threats
- xyproto Algernon source disclosure via NTFS filename manipulation
- GO-2026-5300 - Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xypr
- xyproto Algernon path traversal and RCE via Host header
- xyproto Algernon permissive CORS policy in SSE event server
- xyproto Algernon information disclosure in single-file mode