CVE-2026-63641

MagicMirror² (open-source smart mirror platform) prior to 2.37.0 applies ipWhitelist only as Express middleware, leaving the Socket.IO server in js/server.js without equivalent IP allowlist, origin, or namespace authentication. In a non-loopback deployment relying on ipWhitelist, an unauthenticat...

CVE-2026-63641 MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks...