Prior to version 1.17.7, Algernon’s SSE event server automatically bound to all network interfaces by default on Linux and macOS, exposing the default port 5553 to any host that can reach the server. The description does not mention authentication or authorization on the SSE endpoint, and therefore it is inferred that the endpoint accepts connections without any verification, allowing unauthorized parties to receive streamed event data.

The affected product is the xyproto:algernon web server, specifically all releases before 1.17.7 that run on Linux or macOS. The vulnerability arises from the platform-dependent host default that resolves an empty host string to a binding on 0.0.0.0, thereby listening on every network interface.

The CVSS score of 4.3 indicates a low severity issue. Exploitation requires network connectivity to TCP port 5553 and the open binding creates an unrestricted attack surface. No EPSS metric is available and the vulnerability is not listed in CISA’s KEV catalog. Attackers could issue simple HTTP requests to the SSE endpoint, potentially receiving sensitive event data, but the impact is limited to information disclosure rather than code execution or system compromise.