CVE-2026-63640
Received Received - Intake

Information Disclosure in MagicMirror² via Secret Replacement

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-63640
EUVD
EUVD-2026-61079

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
magicmirror magicmirror 2.37.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MagicMirror² (CVE-2026-63640) allows unauthorized access to environment variables marked as SECRET_*. When hideConfigSecrets is enabled, socket payloads can expand placeholders like SECRET_API_KEY with actual values. Attackers can exploit this by sending manipulated payloads to a module's Socket.IO namespace, causing secrets to be disclosed in error responses or other module outputs.

Detection Guidance

Check MagicMirror version with npm list -g magicmirror or cat package.json. If version is below 2.37.0, the system is vulnerable. Monitor network traffic for unexpected secret exposure in socket payloads using tools like Wireshark or tcpdump on ports used by MagicMirror.

Impact Analysis

If exploited, this vulnerability could expose sensitive API tokens, credentials, or service keys stored in SECRET_ environment variables. Attackers with local network access could retrieve these secrets, potentially leading to unauthorized access to external services or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using MagicMirror² may face compliance violations and potential legal consequences if secrets are exposed.

Mitigation Strategies

Upgrade MagicMirror to version 2.37.0 or later immediately. If upgrading is not possible, disable the hideConfigSecrets feature in config.js or restrict Socket.IO access to trusted networks only. Remove any SECRET_* placeholders from module configurations to prevent expansion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63640. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart