VulnSocial

CVE-2026-63643

LOWCVSS 6.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handler passes these fields to CalendarFetcher, causing a server-side request without SSRF validation and optionally disabling TLS verification. When the response is valid iCal, CALENDAR_EVENTS returns parsed event data to the attacker, allowing internal-service response data to be exfiltrated; other responses still provide a blind request and timing primitive. This issue is fixed in version 2.37.0.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-441CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-01: 110-01
Referenced assets1 URL
By indicator
Full discourse1 post
  • Hakai Security@HakaiOffsec

    Mirror, mirror on the wall! Gabriel Alves, an analyst on our team, recently reported two CVEs: CVE-2026-63642 and CVE-2026-63643. Both are Server-Side Request Forgery (SSRF) vulnerabilities identified in MagicMirror². How do they work? The flaws are related to URL processing in the newsfeed and calendar modules, allowing requests to be made by the server to attacker-controlled destinations. What is the impact? An attacker can use the application to make requests against internal resources that are not directly exposed to the Internet, expanding the attack surface and enabling access to services and information available from the environment where MagicMirror² is running. Gabriel is passionate about cybersecurity, with a focus on offensive security, pentest, and vulnerability research. Has practical experience in CTF environments, application analysis, and flaw exploitation, always seeking to refine skills and stay current with new techniques in the field. Author: @Gabrie0x6c Check it out: https://surl.li/ewsaed

    02032166
    1.2K followersView on X

Explore more

Back to dashboard