[Pt-Br] Por Trás do Espelho: Investigando Vulnerabilidades no MagicMirror² (CVE-2026-63642, CVE-2026-63643)

Researcher: Gabriel Alves · Published: October 1, 2026 · Source: yokai.hakaisecurity.io

During source code analysis of MagicMirror², an open-source platform used to transform semi-transparent mirrors into smart displays, the Yokai team at Hakai Security identified two Server-Side Request Forgery (SSRF) vulnerabilities: CVE-2026-63642 and CVE-2026-63643.

These flaws reside in different modules and allow externally controlled HTTP requests to be processed by the server:

• CVE-2026-63642 affects the newsfeed module, allowing server-side HEAD requests via article URL verification (Blind SSRF).
• CVE-2026-63643 affects the calendar module, allowing full SSRF where responses can be retrieved.

What is MagicMirror²?

MagicMirror² is an open-source modular smart mirror platform that runs on Raspberry Pi and other systems to display time, weather, news headlines, and calendars.

Reference: MagicMirror²

Vulnerability Details

1. Blind SSRF in newsfeed (CVE-2026-63642)

The checkArticleUrl() function in defaultmodules/newsfeed/node_helper.js performs an HTTP HEAD request to a user-provided URL without adequate destination validation:

javascriptCopy

// defaultmodules/newsfeed/node_helper.js
checkArticleUrl: function (url) {
    // sends HEAD request to arbitrary url without restriction
}

Because the request uses HEAD, the response body is not returned to the client, constituting a Blind SSRF. Differences in response status and processing times can be leveraged to map internal networks and identify available internal services.

2. Full SSRF in calendar (CVE-2026-63643)

The ADD_CALENDAR Socket.IO handler in modules/calendar/node_helper.js forwards incoming payloads directly to the calendar fetcher component without validation or destination restriction.

Unlike the project's /cors endpoint (which contains destination validation controls), the ADD_CALENDAR handler lacks equivalent protection, allowing an attacker to coerce the server into fetching arbitrary internal resources and observing the returned contents through the calendar module workflow.

Exploitation

Exploiting Blind SSRF (CVE-2026-63642)

The PoC connects to the /newsfeed namespace over Socket.IO and emits the CHECK_ARTICLE_URL event with an attacker-controlled target URL. MagicMirror² processes the event and issues the HTTP HEAD request from the server.

Public Exploit: Hakai Security CVE-2026-63642 Repository

Exploiting SSRF (CVE-2026-63643)

The PoC connects to the /calendar namespace over Socket.IO and sends the ADD_CALENDAR event containing the target internal URL. The server issues the request and returns the fetched content, enabling access to internal endpoints and cloud metadata services.

Responsible Disclosure

Both vulnerabilities were identified by Gabriel Alves (Yokai Research / Hakai Security) and reported via GitHub Security Advisories:

• CVE-2026-63642: Blind SSRF in newsfeed module (Affects version 2.36.0, fixed in 2.37.0+)
• CVE-2026-63643: Full SSRF in calendar module (Affects version 2.36.0, fixed in 2.37.0+)

Implemented Fixes

The vulnerabilities were resolved in commit 58c2a5e and released in v2.37.0.

The fix implements an access control mechanism for Socket.IO connections, enforcing the server's ipWhitelist configuration on WebSocket connections.

In js/ip_access_control.js, socketIpAccessControl() verifies the client IP during the Socket.IO handshake:

javascriptCopy

function socketIpAccessControl(whitelist) {
    return (req, callback) => {
        // enforce whitelist on socket.io requests
    };
}

In js/server.js:

javascriptCopy

allowRequest: socketIpAccessControl(config.ipWhitelist),

This prevents unauthorized remote clients from connecting to the Socket.IO namespaces used by newsfeed and calendar.

Modified files:

• js/ip_access_control.js lines 90–107
• js/server.js line 44

Mitigation

1. Upgrade: Update MagicMirror² to version 2.37.0 or later.
2. Access Control: Restrict MagicMirror² network interfaces to trusted local networks. Do not expose the application directly to the public internet.
3. Whitelist Configuration: Review ipWhitelist in config/config.js to ensure only legitimate local clients are permitted.

---

📦 Full-Text Markdown Snapshot archived by Phying News · Original source: yokai.hakaisecurity.io

---
id: 9148
canonical_url: "https://phying.com/item/9148"
title: "[Pt-Br] Por Trás do Espelho: Investigando Vulnerabilidades no MagicMirror² (CVE-2026-63642, CVE-2026-63643)"
type: "vulnerability"
cve: "CVE-2026-63642, CVE-2026-63643"
cvss: null
severity: "high"
vendor: "MagicMirrorOrg"
product: "MagicMirror²"
affected_versions: "2.36.0"
source_domain: "yokai.hakaisecurity.io"
source_url: "https://yokai.hakaisecurity.io/pt-br-por-tras-do-espelho-investigando-vulnerabilidades-no-magicmirror2-cve-2026-63642-cve-2026-63643/"
published_at: "2026-10-01T19:57:45Z"
snapshot_at: "2026-10-26T05:55:00Z"
archived_by: "Phying News (https://phying.com/item/9148)"
lang: "en"
---

# Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)

*Researcher: Gabriel Alves · Published: October 1, 2026 · Source: [yokai.hakaisecurity.io](https://yokai.hakaisecurity.io/pt-br-por-tras-do-espelho-investigando-vulnerabilidades-no-magicmirror2-cve-2026-63642-cve-2026-63643/)*

![MagicMirror Research Banner](https://yokai.hakaisecurity.io/content/images/size/w2000/2026/10/ARTIGO_MAGICMIRROR_GABRIEL1.png)

During source code analysis of **MagicMirror²**, an open-source platform used to transform semi-transparent mirrors into smart displays, the **Yokai team at Hakai Security** identified two Server-Side Request Forgery (SSRF) vulnerabilities: [CVE-2026-63642](https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g) and [CVE-2026-63643](https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w6x9-28jw-hq7j).

These flaws reside in different modules and allow externally controlled HTTP requests to be processed by the server:
- **CVE-2026-63642** affects the `newsfeed` module, allowing server-side `HEAD` requests via article URL verification (Blind SSRF).
- **CVE-2026-63643** affects the `calendar` module, allowing full SSRF where responses can be retrieved.

## What is MagicMirror²?

MagicMirror² is an open-source modular smart mirror platform that runs on Raspberry Pi and other systems to display time, weather, news headlines, and calendars.

Reference: [`MagicMirror²`](https://magicmirror.builders/)

![MagicMirror Display](https://yokai.hakaisecurity.io/content/images/2026/09/image-2.png)

## Vulnerability Details

### 1. Blind SSRF in `newsfeed` (CVE-2026-63642)

The `checkArticleUrl()` function in `defaultmodules/newsfeed/node_helper.js` performs an HTTP `HEAD` request to a user-provided URL without adequate destination validation:

```javascript
// defaultmodules/newsfeed/node_helper.js
checkArticleUrl: function (url) {
    // sends HEAD request to arbitrary url without restriction
}
```

Because the request uses `HEAD`, the response body is not returned to the client, constituting a **Blind SSRF**. Differences in response status and processing times can be leveraged to map internal networks and identify available internal services.

### 2. Full SSRF in `calendar` (CVE-2026-63643)

The `ADD_CALENDAR` Socket.IO handler in `modules/calendar/node_helper.js` forwards incoming payloads directly to the calendar fetcher component without validation or destination restriction.

Unlike the project's `/cors` endpoint (which contains destination validation controls), the `ADD_CALENDAR` handler lacks equivalent protection, allowing an attacker to coerce the server into fetching arbitrary internal resources and observing the returned contents through the calendar module workflow.

## Exploitation

### Exploiting Blind SSRF (CVE-2026-63642)

The PoC connects to the `/newsfeed` namespace over **Socket.IO** and emits the `CHECK_ARTICLE_URL` event with an attacker-controlled target URL. MagicMirror² processes the event and issues the HTTP `HEAD` request from the server.

Public Exploit: [Hakai Security CVE-2026-63642 Repository](https://github.com/hakaioffsec/CVE-2026-63642)

![Exploiting CVE-2026-63642](https://blog.hackingclub.com/content/images/2026/09/image-1.png)

### Exploiting SSRF (CVE-2026-63643)

The PoC connects to the `/calendar` namespace over **Socket.IO** and sends the `ADD_CALENDAR` event containing the target internal URL. The server issues the request and returns the fetched content, enabling access to internal endpoints and cloud metadata services.

![Exploiting CVE-2026-63643](https://blog.hackingclub.com/content/images/2026/09/image-3.png)

## Responsible Disclosure

Both vulnerabilities were identified by Gabriel Alves (Yokai Research / Hakai Security) and reported via GitHub Security Advisories:
- **CVE-2026-63642**: Blind SSRF in `newsfeed` module (Affects version 2.36.0, fixed in 2.37.0+)
- **CVE-2026-63643**: Full SSRF in `calendar` module (Affects version 2.36.0, fixed in 2.37.0+)

## Implemented Fixes

The vulnerabilities were resolved in commit [`58c2a5e`](https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e) and released in **v2.37.0**.

The fix implements an access control mechanism for **Socket.IO** connections, enforcing the server's `ipWhitelist` configuration on WebSocket connections.

In `js/ip_access_control.js`, `socketIpAccessControl()` verifies the client IP during the Socket.IO handshake:

```javascript
function socketIpAccessControl(whitelist) {
    return (req, callback) => {
        // enforce whitelist on socket.io requests
    };
}
```

In `js/server.js`:

```javascript
allowRequest: socketIpAccessControl(config.ipWhitelist),
```

This prevents unauthorized remote clients from connecting to the `Socket.IO` namespaces used by `newsfeed` and `calendar`.

Modified files:
- [`js/ip_access_control.js` lines 90–107](https://github.com/MagicMirrorOrg/MagicMirror/blob/58c2a5e/js/ip_access_control.js#L90-L107)
- [`js/server.js` line 44](https://github.com/MagicMirrorOrg/MagicMirror/blob/58c2a5e/js/server.js#L44)

## Mitigation

1. **Upgrade**: Update MagicMirror² to version **2.37.0** or later.
2. **Access Control**: Restrict MagicMirror² network interfaces to trusted local networks. Do not expose the application directly to the public internet.
3. **Whitelist Configuration**: Review `ipWhitelist` in `config/config.js` to ensure only legitimate local clients are permitted.

---
> 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/9148) · Original source: [yokai.hakaisecurity.io](https://yokai.hakaisecurity.io/pt-br-por-tras-do-espelho-investigando-vulnerabilidades-no-magicmirror2-cve-2026-63642-cve-2026-63643/)