CVE-2026-63641: MagicMirror Socket.IO auth bypass allows unauthenticated module commands

CVE-2026-63641 · Severity: medium · CVSS 4 · Published 2026-08-18

MagicMirror is a Node.js application that displays information on smart mirrors. The application applies IP address filtering only to its HTTP routes, but not to its Socket.IO real-time communication server. In deployments where MagicMirror is exposed to a network (rather than loopback only), an attacker can bypass IP filtering by connecting directly to Socket.IO and sending arbitrary commands to module helpers, leading to server-side requests to internal services and potentially arbitrary command execution.

Technologies: MagicMirrorOrg MagicMirror², magicmirror (npm). Vendors: MagicMirrorOrg, npm.

Quick answers

Is CVE-2026-63641 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63641 being exploited in the wild.
How severe is CVE-2026-63641?
Medium severity, with a CVSS score of 4, published 18 August 2026.
Which products and versions are affected?
MagicMirrorOrg MagicMirror² < 2.37.0; magicmirror (npm) SEMVER:introduced=0,fixed=2.37.0.
Is there a fix for CVE-2026-63641?
Yes. magicmirror (npm): upgrade to 2.37.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63641 attacked?
It is attacked over the network or from the adjacent network, in a web application.
Am I affected by CVE-2026-63641?
Check whether you run MagicMirrorOrg MagicMirror² or magicmirror (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • magicmirror (npm): upgrade to 2.37.0 or later
    npm install magicmirror@2.37.0

Technical details

The vulnerability is a trust-boundary bypass where Socket.IO module namespaces lack the same IP-based access control applied to Express HTTP routes. MagicMirror configures Socket.IO with overly permissive CORS (origin: /.*$/) and attaches it to the raw HTTP server before Express middleware is registered (js/server.js:42–50). The ipAccessControl middleware protecting Express routes (js/server.js:89–90) does not apply to Socket.IO handshakes or namespace connections. Once connected, an attacker can send arbitrary notifications to any module's socketNotificationReceived handler without authentication. Default modules expose multiple impacts: the newsfeed module accepts CHECK_ARTICLE_URL and performs server-side HEAD requests to attacker-supplied URLs (SSRF); the updatenotification module accepts CONFIG notifications containing update commands and executes them via child_process.exec when a third-party module is considered behind. The vulnerability requires network reachability to the Socket.IO port (non-loopback binding) but not authentication, and the RCE variant requires a pending third-party module update but the command source is attacker-controlled through the unauthenticated socket path.

Affected products

  • MagicMirrorOrg MagicMirror < 2.37.0

Identifiers

  • CVE-2026-63641
  • GHSA-w26r-fwg8-rcp3

Timeline

  • 2026-07-01: disclosed
  • 2026-08-18: advisory
  • 2026: patched: Patched version 2.37.0 available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.