Xyproto Algernon missing authentication in auto-refresh SSE server

Executive brief

Algernon, a web server and development tool, contains a security flaw in its auto-refresh feature. This feature allows anyone on the network to see which files a developer is currently editing and view the project's directory structure without needing a password. This could lead to the exposure of sensitive file names or internal project details to unauthorized users.

Technical details

The auto-refresh functionality in Algernon utilizes a Server-Sent Events (SSE) handler that fails to implement any authentication or authorization checks. The handler, located in the recwatch component, binds to all interfaces and sets 'Access-Control-Allow-Origin: *', making it accessible to any client capable of establishing a TCP connection. Because the listener operates on its own http.ServeMux, it bypasses standard middleware protections like permissions2. An attacker can connect to the SSE endpoint (typically on port 5553) to receive a real-time stream of filesystem events, revealing sensitive filenames and directory layouts. This issue is addressed in version 1.17.7.

Affected products

• xyproto algernon <= 1.17.6

Timeline

• 2026-05-12: disclosed
• 2026-05-19: advisory
• 2026-05-19: patched: Version 1.17.7 released

References

• https://api.github.com/users/Dredsen
• https://github.com/Dredsen
• https://api.github.com/users/Dredsen/gists%7B/gist_id%7D
• https://api.github.com/users/Dredsen/repos
• https://avatars.githubusercontent.com/u/24421368?v=4
• https://api.github.com/users/Dredsen/events%7B/privacy%7D