Skip to content
OpenAdvisories

Vendor

MagicMirrorOrg

5 known vulnerabilities.

Products

MagicMirror 5
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.3
    CVE-2026-63641

    MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

    MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, orig…

    MagicMirrorOrg MagicMirror magicmirror npm