CVE-2026-63643

A flaw was found in MagicMirror². This flaw involves a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to cause the server to make requests to arbitrary domains. Specifically, the ADD_CALENDAR handler in the defaultmodules/calendar/node_helper.js component, accessible via the unauthenticated Socket.IO namespace /calendar, accepts attacker-controlled URLs and other settings. An unauthenticated remote attacker can exploit this by providing a malicious URL, leading to the exfiltration of internal service response data if the response is a valid iCal. Even with invalid iCal responses, the attacker can perform blind requests and timing attacks.