Algernon a lightweight pure-Go web server has a weakness where the Server-Sent Events (SSE) endpoint responds with the header Access-Control-Allow-Origin set to the wildcard *, disregarding the request’s Origin header. This allows anyone who can load a third‑party web page to establish an EventSource connection to the SSE port and read the live stream of filename updates. Because the SSE stream can reveal internal server paths, file names, and potentially other sensitive metadata, an attacker gains information disclosure and a foothold for further reconnaissance. The flaw is a classic CORS misconfiguration (CWE‑942).

The affected system is the xyproto Algernon web server. All releases prior to version 1.17.7 contain the flaw; version 1.17.7 and later have fixed the header handling.

The CVSS score of 4.3 indicates moderate severity. EPSS data is not available, but the vulnerability is not catalogued in CISA’s KEV list, suggesting no widely known exploits. Attackers can exploit the flaw simply by hosting a malicious page that opens an EventSource connection, as the protocol does not perform a preflight check and does not send cookies. Successful exploitation results in the attacker being able to read the exposed filename stream but does not give code execution or privilege escalation.