CVE-2026-63641 MagicMirrorOrg CVE debrief

Who should care

Defenders responsible for MagicMirror² deployments, especially those relying on ipWhitelist, should assess exposure and verify network configuration to prevent unauthorized access. This vulnerability can potentially expose internal services, manipulate module-helper state, and conditionally execute commands.

Why it matters

CVE-2026-63641 is a low-severity vulnerability in MagicMirror² that allows an unauthenticated adjacent-network client to connect directly to module Socket.IO namespaces, potentially exposing internal services, manipulating module-helper state, and conditionally executing commands. Defenders should prioritize verifying exposure and assessing network configuration to prevent unauthorized access.

• Potential exposure of internal services to adjacent-network attackers
• Possible manipulation of module-helper state
• Conditional execution of commands through socketNotificationReceived
• Verification of MagicMirror² instance exposure and network configuration

Technical summary

The MagicMirror² platform prior to version 2.37.0 applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. This allows an unauthenticated adjacent-network client to connect directly to module Socket.IO namespaces and dispatch arbitrary events and payloads to socketNotificationReceived.

Defensive priority

Defenders should prioritize verifying exposure of MagicMirror² instances, especially those relying on ipWhitelist, and assess the network configuration to prevent unauthorized access.

Recommended defensive actions

• Verify MagicMirror² instances are not exposed to unauthorized networks
• Assess network configuration to prevent adjacent-network access
• Update to version 2.37.0 or later
• Review module-helper state and server-side requests for potential manipulation
• Confirm whether affected MagicMirror² deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the scope of affected deployments and the exact impact on module-helper state require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.