# CVE-2026-63643: MagicMirror server-side request forgery in calendar module

Source: https://junglewise.ai/threats/cve-2026-63643-magicmirror-server-side-request-forgery-in-calendar-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63643 · Severity: medium · CVSS 4 · Published 2026-08-18

MagicMirror is a smart display platform used to show calendars and other information on mirror screens. An unauthenticated attacker with network access to the mirror's HTTP port can force the server to make arbitrary HTTP requests to internal or external targets, including cloud metadata services and private network hosts. When calendar responses are returned in iCalendar format, the attacker can read the full response body, enabling data theft from services not directly accessible to the attacker.

Technologies: [magicmirror (npm)](https://junglewise.ai/threats/technologies/npm-magicmirror). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-63643 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63643 being exploited in the wild.

**How severe is CVE-2026-63643?** Medium severity, with a CVSS score of 4, published 18 August 2026.

**Which products and versions are affected?** magicmirror (npm) SEMVER:introduced=0,fixed=2.37.0.

**Is there a fix for CVE-2026-63643?** Yes. magicmirror (npm): upgrade to 2.37.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63643 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-63643?** Check whether you run magicmirror (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- magicmirror (npm): upgrade to 2.37.0 or later

  ```sh
  npm install magicmirror@2.37.0
  ```


## Technical details

The calendar module in MagicMirror accepts a socket.io notification called `ADD_CALENDAR` without authentication, allowing any browser or process reaching the mirror's port to trigger it. The handler passes an attacker-controlled URL, authentication headers, and a `selfSignedCert` flag directly to a calendar fetcher that makes a server-side HTTP request. The socket.io server is configured with permissive CORS (`origin: /.*$/`) and no connection-level authentication (CWE-306, CWE-918). If the server's response is valid iCalendar format, events are parsed and sent back to the attacker via `CALENDAR_EVENTS`, enabling full response body exfiltration. The attacker can also inject arbitrary `Authorization: Bearer` headers (confused deputy attack) and disable TLS certificate verification. The vulnerability affects versions before 2.37.0 and is reachable over the network if the mirror's HTTP port is accessible.

## Affected products

- MagicMirror Organization MagicMirror < 2.37.0

## Identifiers

- CVE-2026-63643
- GHSA-w6x9-28jw-hq7j

## Timeline

- 2026-08-18: disclosed: GitHub advisory published
- 2026-07-01: patched: Fix released in version 2.37.0

## References

- [https://api.github.com/users/gabrie0x6c](https://api.github.com/users/gabrie0x6c)
- [https://github.com/gabrie0x6c](https://github.com/gabrie0x6c)
- [https://api.github.com/users/gabrie0x6c/gists%7B/gist_id%7D](https://api.github.com/users/gabrie0x6c/gists%7B/gist_id%7D)
- [https://api.github.com/users/gabrie0x6c/repos](https://api.github.com/users/gabrie0x6c/repos)
- [https://avatars.githubusercontent.com/u/91026689?v=4](https://avatars.githubusercontent.com/u/91026689?v=4)
- [https://api.github.com/users/gabrie0x6c/events%7B/privacy%7D](https://api.github.com/users/gabrie0x6c/events%7B/privacy%7D)

## Related threats

- [MagicMirror socket payload secret placeholder expansion](https://junglewise.ai/threats/cve-2026-63640-magicmirror-socket-payload-secret-placeholder-expansion)
- [MagicMirror newsfeed server-side request forgery in CHECK_ARTICLE_URL](https://junglewise.ai/threats/cve-2026-63642-magicmirror-newsfeed-server-side-request-forgery-in-check-article)
- [MagicMirror Socket.IO auth bypass allows unauthenticated module commands](https://junglewise.ai/threats/cve-2026-63641-magicmirror-socket-io-auth-bypass-allows-unauthenticated-module)
- [MagicMirrorOrg MagicMirror² SSRF and secret exfiltration in /cors endpoint](https://junglewise.ai/threats/cve-2026-42281-magicmirrororg-magicmirror-ssrf-and-secret-exfiltration-in-cors)