Description
MagicMirror applies ipWhitelist only as Express middleware, but the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks.
Recommendation
Update the magicmirror package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.37.0
- Patched version(s): 2.37.0
References
Could your website be exposed too?
SmartScanner can check your website for MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions and gives you actionable findings to investigate.
Start a free scanRelated Issues
- MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery - CVE-2026-63642
- LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read - CVE-2026-39859
- Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes - CVE-2026-119200
- @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) - CVE-2026-111752
You might also like:
See something that needs correcting? Let us knowUpdated August 18, 2026