CVE-2026-63643
Received Received - Intake

Server-Side Request Forgery in MagicMirror²

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handler passes these fields to CalendarFetcher, causing a server-side request without SSRF validation and optionally disabling TLS verification. When the response is valid iCal, CALENDAR_EVENTS returns parsed event data to the attacker, allowing internal-service response data to be exfiltrated; other responses still provide a blind request and timing primitive. This issue is fixed in version 2.37.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-63643
EUVD
EUVD-2026-61071

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
magicmirror magicmirror to 2.37.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63643 is a Server-Side Request Forgery (SSRF) vulnerability in MagicMirror² affecting versions up to v2.36.0. The flaw exists in the calendar module's ADD_CALENDAR handler, which allows an attacker to force the server to make HTTP requests to arbitrary internal or external URLs without proper SSRF protections. The vulnerability is exacerbated by the attacker's ability to control authentication headers, TLS verification settings, and other request parameters.

Detection Guidance

Check if your MagicMirror² instance is running a vulnerable version (below 2.37.0) by inspecting the version in package.json or running npm list magicmirror. Monitor network traffic for unexpected outbound requests from the MagicMirror² process, especially to internal IP ranges or unusual domains. Review socket.io connections to the /calendar namespace for unauthenticated requests.

Impact Analysis

This vulnerability allows an attacker to read internal services, exfiltrate sensitive data if responses contain iCal events with secrets, inject credentials via attacker-controlled Authorization headers, bypass TLS verification, and perform internal port scanning through error or timing differences.

Mitigation Strategies

Upgrade MagicMirror² to version 2.37.0 or later immediately. If upgrading is not possible, disable the calendar module or restrict socket.io access to trusted origins only. Block unauthenticated connections to the /calendar namespace and ensure TLS verification is enforced for all external requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63643. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart