CVE-2026-63640: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in MagicMirrorOrg MagicMirror
MagicMirror² versions prior to 2.37.0 contain a vulnerability where sensitive environment variables can be exposed to unauthorized clients. When the hideConfigSecrets feature is enabled, a client connected to a module namespace can submit a placeholder that the server replaces with secret environment values, which are then echoed back via the default weather helper module. This allows disclosure of API tokens or credentials stored in SECRET_ variables. The issue is fixed in version 2.37.0.
AI Analysis
Technical Summary
MagicMirror² is an open source smart mirror platform. In versions before 2.37.0, when hideConfigSecrets is enabled, the socket dispatcher passes inbound payloads through a function that replaces secret placeholders with actual environment variable values. A client can submit a SECRET_API_KEY placeholder, causing the server to replace it with the secret value. The default weather helper module then echoes back the attacker-controlled instanceId in an error message, effectively leaking the secret. This breaks the intended one-way redaction and exposes sensitive information such as API tokens or service keys stored in environment variables prefixed with SECRET_. The vulnerability is addressed in version 2.37.0.
Potential Impact
An attacker with network access to a loaded module namespace can cause the server to disclose sensitive environment variables containing API tokens, credentials, or service keys. This exposure can lead to unauthorized access to services relying on these secrets. The impact is limited to confidentiality (information disclosure) with no integrity or availability impact reported.
Mitigation Recommendations
Upgrade MagicMirror² to version 2.37.0 or later, where this vulnerability is fixed. No other official remediation or temporary workaround is documented. Patch status is confirmed fixed in 2.37.0.
CVE-2026-63640: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in MagicMirrorOrg MagicMirror
Description
MagicMirror² versions prior to 2.37.0 contain a vulnerability where sensitive environment variables can be exposed to unauthorized clients. When the hideConfigSecrets feature is enabled, a client connected to a module namespace can submit a placeholder that the server replaces with secret environment values, which are then echoed back via the default weather helper module. This allows disclosure of API tokens or credentials stored in SECRET_ variables. The issue is fixed in version 2.37.0.
CVSS v3.1
Score 4.3medium
Affected software
pkg:github/magicmirrororg/MagicMirrorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
MagicMirror² is an open source smart mirror platform. In versions before 2.37.0, when hideConfigSecrets is enabled, the socket dispatcher passes inbound payloads through a function that replaces secret placeholders with actual environment variable values. A client can submit a SECRET_API_KEY placeholder, causing the server to replace it with the secret value. The default weather helper module then echoes back the attacker-controlled instanceId in an error message, effectively leaking the secret. This breaks the intended one-way redaction and exposes sensitive information such as API tokens or service keys stored in environment variables prefixed with SECRET_. The vulnerability is addressed in version 2.37.0.
Potential Impact
An attacker with network access to a loaded module namespace can cause the server to disclose sensitive environment variables containing API tokens, credentials, or service keys. This exposure can lead to unauthorized access to services relying on these secrets. The impact is limited to confidentiality (information disclosure) with no integrity or availability impact reported.
Mitigation Recommendations
Upgrade MagicMirror² to version 2.37.0 or later, where this vulnerability is fixed. No other official remediation or temporary workaround is documented. Patch status is confirmed fixed in 2.37.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-17T14:11:15.483Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a849b5fc6e8be03328d6f66
Added to database: 08/18/2026, 17:50:23 UTC
Last enriched: 08/18/2026, 18:05:43 UTC
Last updated: 08/19/2026, 00:23:14 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.