CVE-2026-46431 Details
Description
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard * regardless of the caller's Origin. Because EventSource does not preflight and does not send cookies, the wildcard is sufficient to let any third-party page the developer visits open a cross-origin EventSource to the SSE port and read the live filename stream from JavaScript. This vulnerability is fixed in 1.17.7.
A cross-origin resource sharing (CORS) vulnerability has been identified in Algernon versions prior to 1.17.7. The issue arises in the server-sent events (SSE) event server, where the Access-Control-Allow-Origin response header was fixed to the wildcard '*', regardless of the request's Origin. This misconfiguration allows any third-party webpage to establish a cross-origin EventSource connection to the SSE port and access the live filename stream via JavaScript. The vulnerability is exploitable because EventSource requests do not include cookies or preflight options, making the wildcard sufficient for unauthorized access.
Update to Algernon version 1.17.7 or later, and consider removing the dedicated SSE event server port code path to simplify CORS handling.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 26, 2026CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xyproto/algernon/security/advisories/GHSA-hw27-4v2q-5qff | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/xyproto/algernon/security/advisories/GHSA-hw27-4v2q-5qff | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Algernon | <= 1.17.6 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |