CVE-2026-63643: MagicMirror² SSRF Vulnerability

CVE-2026-63643 Overview

CVE-2026-63643 is a Server-Side Request Forgery (SSRF) vulnerability in MagicMirror², an open source modular smart mirror platform. The flaw exists in the ADD_CALENDAR handler within default/modules/calendar/node_helper.js prior to version 2.37.0. The handler accepts attacker-controlled URLs, authentication data, and a selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. Attackers can force the server to issue arbitrary outbound requests without SSRF validation and optionally disable TLS verification. When responses contain valid iCal data, parsed events return to the attacker through CALENDAR_EVENTS, enabling internal-service data exfiltration. The issue is classified under CWE-441 and is fixed in version 2.37.0.

Critical Impact
Unauthenticated attackers can pivot MagicMirror² instances into internal network scanners, exfiltrate iCal-parseable responses from internal services, and bypass TLS validation on outbound requests.

Affected Products

MagicMirror² versions prior to 2.37.0
default/modules/calendar/node_helper.js (ADD_CALENDAR handler)
Socket.IO namespace /calendar exposed by the MagicMirror² server

Discovery Timeline

2026-08-18 - CVE-2026-63643 published to NVD
2026-08-19 - Last updated in NVD database
v2.37.0 - MagicMirror² releases patched version

Technical Details for CVE-2026-63643

Vulnerability Analysis

MagicMirror² exposes a Socket.IO namespace /calendar that processes ADD_CALENDAR messages without authentication. The handler forwards user-supplied fields directly to the internal CalendarFetcher component. This creates a full SSRF primitive because no URL validation, allowlisting, or destination filtering is applied before the outbound request executes.

The handler also honors an attacker-controlled selfSignedCert flag. Setting this option disables TLS certificate verification for the outbound request, extending the attack surface to internal HTTPS endpoints using self-signed or expired certificates. When the fetched response parses as valid iCal, the server emits CALENDAR_EVENTS back to the connected client, returning parsed content to the attacker.

Even when the response is not valid iCal, the request still succeeds server-side. This provides a blind SSRF primitive with observable timing behavior, sufficient for internal port scanning, service enumeration, and interaction with metadata endpoints on cloud-hosted instances.

Root Cause

The root cause is missing input validation on network destinations combined with unauthenticated access to the /calendar Socket.IO namespace. The handler trusts client-supplied URLs, credentials, and TLS-verification settings without applying an allowlist, denying internal IP ranges, or requiring authentication. This maps to CWE-441: Unintended Proxy or Intermediary (Confused Deputy).

Attack Vector

An attacker connects to the MagicMirror² server's Socket.IO endpoint over the network and joins the /calendar namespace. They emit an ADD_CALENDAR event with a target URL pointing at an internal service, along with optional authentication data and selfSignedCert: true. The server issues the request on the attacker's behalf and returns any parseable iCal content through CALENDAR_EVENTS.

javascript

// Security patch in js/ip_access_control.js
// fix(server): enforce ipWhitelist for Socket.IO too (#4169)

/**
 * Resolves a client IP for both Express and Socket.IO requests.
 * If the direct peer is loopback, trust the first X-Forwarded-For value (local reverse proxy case).
 * Otherwise ignore X-Forwarded-For to prevent spoofing.
 * @param {object} req - Incoming request object (Express request or Socket.IO handshake request)
 * @returns {string} The resolved client IP address
 */
function resolveClientIp (req) {
	const directIp = req.socket?.remoteAddress || req.connection?.remoteAddress || req.ip;
	const LOOPBACK_WHITELIST = ["127.0.0.1", "::ffff:127.0.0.1", "::1"];

	if (isAllowed(directIp, LOOPBACK_WHITELIST)) {
		const forwardedFor = req.headers?.["x-forwarded-for"];
		if (typeof forwardedFor === "string" && forwardedFor.trim().length > 0) {
			return forwardedFor.split(",")[0].trim();
		}
	}

	return directIp;
}

Source: GitHub Commit 58c2a5e. The patch extends the existing ipWhitelist enforcement to Socket.IO connections, ensuring that unauthenticated attackers cannot reach the /calendar namespace from disallowed IP ranges.

Detection Methods for CVE-2026-63643

Indicators of Compromise

Socket.IO connections to the /calendar namespace from IP addresses outside expected LAN ranges.
Outbound HTTP or HTTPS requests from the MagicMirror² host to internal RFC1918 addresses, cloud metadata endpoints (169.254.169.254), or localhost services.
MagicMirror² process initiating TLS connections with certificate verification disabled.
ADD_CALENDAR events containing URLs pointing at non-calendar hostnames or internal infrastructure.

Detection Strategies

Inspect MagicMirror² application logs for ADD_CALENDAR handler invocations and cross-reference target URLs against expected calendar providers.
Monitor egress network traffic from hosts running MagicMirror² for anomalous destinations, especially internal ranges and cloud metadata services.
Alert on any Socket.IO handshake to the /calendar namespace from a source not on the configured ipWhitelist.

Monitoring Recommendations

Enable verbose logging on the MagicMirror² server and forward logs to a centralized SIEM for correlation.
Baseline normal outbound calendar request destinations and alert on deviations.
Monitor for TLS connections from the MagicMirror² process that skip certificate validation.

How to Mitigate CVE-2026-63643

Immediate Actions Required

Upgrade MagicMirror² to version 2.37.0 or later immediately.
Restrict network exposure of the MagicMirror² server to trusted LAN segments only; do not expose it to the internet.
Configure the ipWhitelist option in config.js to allow only trusted client IP addresses.
Audit existing calendar module configurations for unexpected or attacker-planted URLs.

Patch Information

The fix is available in MagicMirror² v2.37.0. Technical details are documented in GHSA-w6x9-28jw-hq7j and Pull Request #4169. The patch enforces ipWhitelist access control on Socket.IO connections, closing the unauthenticated path to the /calendar namespace.

Workarounds

Place the MagicMirror² server behind a reverse proxy that enforces authentication and blocks external access to Socket.IO endpoints.
Apply host-based firewall rules restricting outbound traffic from the MagicMirror² host to only known calendar provider domains.
Disable the calendar module in config.js until the patch can be applied.

bash

# Configuration example: restrict Socket.IO access via ipWhitelist in config.js
# Edit ~/MagicMirror/config/config.js

module.exports = {
    address: "127.0.0.1",
    port: 8080,
    ipWhitelist: ["127.0.0.1", "::ffff:127.0.0.1", "::1", "192.168.1.0/24"],
    useHttps: true,
    // ... rest of configuration
};

# Then restart the service
pm2 restart MagicMirror