What’s Vulnerable › Vulnerabilities

CVE-2026-46431: Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-26 · updated 2026-07-24
• Weakness: CWE-942

Description

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard * regardless of the caller's Origin. Because EventSource does not preflight and does not send cookies, the wildcard is sufficient to let any third-party page the developer visits open a cross-origin EventSource to the SSE port and read the live filename stream from JavaScript. This vulnerability is fixed in 1.17.7.

Affected products

• xyproto algernon: before 1.17.7

References

• https://github.com/xyproto/algernon/security/advisories/GHSA-hw27-4v2q-5qff
• https://github.com/xyproto/algernon/security/advisories/GHSA-hw27-4v2q-5qff

Get alerted when CVE-2026-46431 or the next vulnerability affects your stack