CVE-2026-63643
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
MagicMirror², an open source modular smart mirror platform, prior to 2.37.0 contains a vulnerability in the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js that accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handler passes these fields to CalendarFetcher, causing a server-side request without SSRF validation and optionally disabling TLS verification. When the response is valid iCal, CALENDAR_EVENTS returns parsed event data to the attacker, allowing internal-service response data to be exfiltrated; other responses still provide a blind request and timing primitive. This issue is fixed in version 2.37.0.
Risk Assessment
The risk includes exfiltration of data from internal services and potential internal network scanning, potentially leading to confidentiality breaches.
Recommendation
It is recommended to upgrade MagicMirror² to version 2.37.0 or later and restrict access to Socket.IO namespaces.
Original NVD description (English source)
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handler passes these fields to CalendarFetcher, causing a server-side request without SSRF validation and optionally disabling TLS verification. When the response is valid iCal, CALENDAR_EVENTS returns parsed event data to the attacker, allowing internal-service response data to be exfiltrated; other responses still provide a blind request and timing primitive. This issue is fixed in version 2.37.0.