# CVE-2026-63641: MagicMirror Socket.IO auth bypass allows unauthenticated module commands

Source: https://junglewise.ai/threats/cve-2026-63641-magicmirror-socket-io-auth-bypass-allows-unauthenticated-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63641 · Severity: medium · CVSS 4 · Published 2026-08-18

MagicMirror is a Node.js application that displays information on smart mirrors. The application applies IP address filtering only to its HTTP routes, but not to its Socket.IO real-time communication server. In deployments where MagicMirror is exposed to a network (rather than loopback only), an attacker can bypass IP filtering by connecting directly to Socket.IO and sending arbitrary commands to module helpers, leading to server-side requests to internal services and potentially arbitrary command execution.

Technologies: [MagicMirrorOrg MagicMirror²](https://junglewise.ai/threats/technologies/magicmirror), [magicmirror (npm)](https://junglewise.ai/threats/technologies/npm-magicmirror). Vendors: [MagicMirrorOrg](https://junglewise.ai/threats/vendors/magicmirrororg), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-63641 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63641 being exploited in the wild.

**How severe is CVE-2026-63641?** Medium severity, with a CVSS score of 4, published 18 August 2026.

**Which products and versions are affected?** MagicMirrorOrg MagicMirror² < 2.37.0; magicmirror (npm) SEMVER:introduced=0,fixed=2.37.0.

**Is there a fix for CVE-2026-63641?** Yes. magicmirror (npm): upgrade to 2.37.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63641 attacked?** It is attacked over the network or from the adjacent network, in a web application.

**Am I affected by CVE-2026-63641?** Check whether you run MagicMirrorOrg MagicMirror² or magicmirror (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- magicmirror (npm): upgrade to 2.37.0 or later

  ```sh
  npm install magicmirror@2.37.0
  ```


## Technical details

The vulnerability is a trust-boundary bypass where Socket.IO module namespaces lack the same IP-based access control applied to Express HTTP routes. MagicMirror configures Socket.IO with overly permissive CORS (origin: /.*$/) and attaches it to the raw HTTP server before Express middleware is registered (js/server.js:42–50). The ipAccessControl middleware protecting Express routes (js/server.js:89–90) does not apply to Socket.IO handshakes or namespace connections. Once connected, an attacker can send arbitrary notifications to any module's socketNotificationReceived handler without authentication. Default modules expose multiple impacts: the newsfeed module accepts CHECK_ARTICLE_URL and performs server-side HEAD requests to attacker-supplied URLs (SSRF); the updatenotification module accepts CONFIG notifications containing update commands and executes them via child_process.exec when a third-party module is considered behind. The vulnerability requires network reachability to the Socket.IO port (non-loopback binding) but not authentication, and the RCE variant requires a pending third-party module update but the command source is attacker-controlled through the unauthenticated socket path.

## Affected products

- MagicMirrorOrg MagicMirror < 2.37.0

## Identifiers

- CVE-2026-63641
- GHSA-w26r-fwg8-rcp3

## Timeline

- 2026-07-01: disclosed
- 2026-08-18: advisory
- 2026: patched: Patched version 2.37.0 available

## References

- [https://api.github.com/users/sondt99](https://api.github.com/users/sondt99)
- [https://github.com/sondt99](https://github.com/sondt99)
- [https://api.github.com/users/sondt99/gists%7B/gist_id%7D](https://api.github.com/users/sondt99/gists%7B/gist_id%7D)
- [https://api.github.com/users/sondt99/repos](https://api.github.com/users/sondt99/repos)
- [https://avatars.githubusercontent.com/u/87920408?v=4](https://avatars.githubusercontent.com/u/87920408?v=4)
- [https://api.github.com/users/sondt99/events%7B/privacy%7D](https://api.github.com/users/sondt99/events%7B/privacy%7D)

## Related threats

- [MagicMirror socket payload secret placeholder expansion](https://junglewise.ai/threats/cve-2026-63640-magicmirror-socket-payload-secret-placeholder-expansion)
- [MagicMirror server-side request forgery in calendar module](https://junglewise.ai/threats/cve-2026-63643-magicmirror-server-side-request-forgery-in-calendar-module)
- [MagicMirror newsfeed server-side request forgery in CHECK_ARTICLE_URL](https://junglewise.ai/threats/cve-2026-63642-magicmirror-newsfeed-server-side-request-forgery-in-check-article)
- [MagicMirrorOrg MagicMirror² SSRF and secret exfiltration in /cors endpoint](https://junglewise.ai/threats/cve-2026-42281-magicmirrororg-magicmirror-ssrf-and-secret-exfiltration-in-cors)