Executive brief
Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xyproto/algernon
Affected products
- Go github.com/xyproto/algernon
Junglewise Threat Intelligence
GO-2026-5300 - Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xypr
Severity: info · Published 2026-06-25
Technologies: github.com/xyproto/algernon (Go). Vendors: Go.
Related threats
- xyproto Algernon source disclosure via NTFS filename manipulation
- xyproto Algernon path traversal and RCE via Host header
- xyproto Algernon permissive CORS policy in SSE event server
- xyproto Algernon information disclosure in single-file mode
- xyproto Algernon remote code execution via handler.lua path traversal