Server-Side Request Forgery Vulnerability in MagicMirror² by MagicMirrorOrg
CVE-2026-63643
What is CVE-2026-63643?
The MagicMirror² platform, a versatile open-source smart mirror solution, contains a vulnerability in the ADD_CALENDAR handler of the calendar module. Prior to version 2.37.0, this handler allows unauthenticated access through the Socket.IO namespace /calendar, allowing attackers to submit a crafted URL, authentication data, and a selfSignedCert setting. Due to insufficient SSL/TLS validation, this could lead to potential server-side request forgery (SSRF) attacks. Exploitation of this vulnerability allows attackers to extract sensitive internal-service response information through valid iCal responses, while still permitting blind requests and timing attacks on other responses. Users are strongly advised to upgrade to version 2.37.0 to mitigate these risks.
Affected Version(s)
MagicMirror < 2.37.0