Description
An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services.
Recommendation
Update the magicmirror package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.35.0
- Patched version(s): 2.36.0
References
Could your website be exposed too?
SmartScanner can check your website for MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) - CVE-2026-41321
- React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint - CVE-2026-42342
- Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline - CVE-2026-27739
- Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint - CVE-2023-46729
You might also like:
See something that needs correcting? Let us knowUpdated June 08, 2026