Data Exposure Vulnerability in MagicMirror² Smart Mirror Platform

CVE-2026-63640

What is CVE-2026-63640?

MagicMirror², an open-source modular smart mirror platform, contains a vulnerability that can lead to the exposure of sensitive information. When the hideConfigSecrets feature is enabled prior to version 2.37.0, the catch-all socket dispatcher improperly handles inbound object payloads. Specifically, it allows attackers to inject a SECRET_API_KEY placeholder, which results in the server revealing the actual environment variables corresponding to those keys. This behavior can be exploited to disclose API tokens, credentials, or service keys stored in SECRET variables, effectively reversing the intended confidentiality protections. Users are advised to update to version 2.37.0 or later to mitigate this risk.

References