CVE-2026-63640: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in MagicMirrorOrg MagicMirror
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.
AI Analysis
Technical Summary
MagicMirror² is an open source smart mirror platform. In versions before 2.37.0, when hideConfigSecrets is enabled, the socket dispatcher passes inbound payloads through a function that replaces secret placeholders with actual environment variable values. A client can submit a SECRET_API_KEY placeholder, causing the server to replace it with the secret value. The default weather helper module then echoes back the attacker-controlled instanceId in an error message, effectively leaking the secret. This breaks the intended one-way redaction and exposes sensitive information such as API tokens or service keys stored in environment variables prefixed with SECRET_. The vulnerability is addressed in version 2.37.0.
Potential Impact
An attacker with network access to a loaded module namespace can cause the server to disclose sensitive environment variables containing API tokens, credentials, or service keys. This exposure can lead to unauthorized access to services relying on these secrets. The impact is limited to confidentiality (information disclosure) with no integrity or availability impact reported.
Mitigation Recommendations
Upgrade MagicMirror² to version 2.37.0 or later, where this vulnerability is fixed. No other official remediation or temporary workaround is documented. Patch status is confirmed fixed in 2.37.0.
CVE-2026-63640: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in MagicMirrorOrg MagicMirror
Description
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.
CVSS v3.1
Score 4.3medium
Affected software
MagicMirrorOrg
MagicMirror
pkg:github/magicmirrororg/MagicMirrorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
MagicMirror² is an open source smart mirror platform. In versions before 2.37.0, when hideConfigSecrets is enabled, the socket dispatcher passes inbound payloads through a function that replaces secret placeholders with actual environment variable values. A client can submit a SECRET_API_KEY placeholder, causing the server to replace it with the secret value. The default weather helper module then echoes back the attacker-controlled instanceId in an error message, effectively leaking the secret. This breaks the intended one-way redaction and exposes sensitive information such as API tokens or service keys stored in environment variables prefixed with SECRET_. The vulnerability is addressed in version 2.37.0.
Potential Impact
An attacker with network access to a loaded module namespace can cause the server to disclose sensitive environment variables containing API tokens, credentials, or service keys. This exposure can lead to unauthorized access to services relying on these secrets. The impact is limited to confidentiality (information disclosure) with no integrity or availability impact reported.
Mitigation Recommendations
Upgrade MagicMirror² to version 2.37.0 or later, where this vulnerability is fixed. No other official remediation or temporary workaround is documented. Patch status is confirmed fixed in 2.37.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-17T14:11:15.483Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a849b5fc6e8be03328d6f66
Added to database: 08/18/2026, 17:50:23 UTC
Last enriched: 08/18/2026, 18:05:43 UTC
Last updated: 10/03/2026, 14:46:09 UTC
Views: 54
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.