---
id: 9149
title: "[EN] Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)"
cve: CVE-2026-63642
source_domain: yokai.hakaisecurity.io
source_url: "https://yokai.hakaisecurity.io/magic-mirror-vulnerabilities-cve-2026-63642-cve-2026-63643-2/"
published_at: "2026-10-01T19:57:34Z"
tags: ["vulnerability-research", "research", "ssrf"]
phying_url: "https://phying.com/item/9149"
lang: en
---

# [EN] Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)

## Summary

During an analysis of the source code of MagicMirror², an open-source platform used to turn a semi-transparent mirror into a smart display, the Yokai Research Team from Hakai Security identified two recent Server-Side Request Forgery (SSRF) vulnerabilities: CVE-2026-63642 and CVE-2026-63643. The vulnerabilities affect

## Intelligence Metadata

- **Sources:** yokai.hakaisecurity.io
- **CVE:** CVE-2026-63642
- **Published:** 2026-10-01T19:57:34Z
- **Original:** https://yokai.hakaisecurity.io/magic-mirror-vulnerabilities-cve-2026-63642-cve-2026-63643-2/
- **Phying News:** https://phying.com/item/9149