EUVD-2026-61079
GHSA-q4gh-4ffp-5cg8
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Adjacent network access without authentication suffices; only confidentiality is impacted as secrets are read but no writes or availability effects occur.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.
AnalysisAI
Secret environment variable disclosure in MagicMirror² before 2.37.0 allows adjacent network attackers to recover live SECRET_* credential values by exploiting a logic inversion in the socket dispatcher. The hideConfigSecrets feature is intended to redact environment secrets from browser-facing config responses, but the node_helper socket catch-all unconditionally expands SECRET_NAME placeholders in every inbound payload before routing to module helpers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) hideConfigSecrets must be set to true in the MagicMirror configuration - this is the feature that establishes the SECRET_* variable naming convention the attacker exploits; (2) the attacker must have Socket.IO connectivity to the MagicMirror server, which by default listens on the local network (AV:A); (3) at least one module namespace must be loaded that echoes attacker-controlled payload fields - the default weather module provides a confirmed echo path via INIT_WEATHER/WEATHER_ERROR, but other custom modules may also qualify. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L) scores 4.3, reflecting adjacent-network access without authentication - consistent with MagicMirror's typical LAN/home-network deployment model. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MagicMirror² to version 2.37.0 or later, which is the vendor-released patch available at https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Magicmirror
View allServer-side request forgery in MagicMirror² versions prior to 2.37.0 allows unauthenticated remote attackers to make the
Unauthenticated Server-Side Request Forgery in MagicMirror² versions prior to 2.37.0 allows any network-reachable attack
Socket.IO namespace access control bypass in MagicMirror² prior to v2.37.0 allows unauthenticated adjacent-network clien
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today