MagicMirror² has a server‑side request forgery vulnerability in its /cors endpoint that lets an unauthenticated attacker send arbitrary HTTP requests to internal IP ranges, cloud metadata services, and localhost. The endpoint also expands environment variable placeholders, providing a path for the exfiltration of server‑side secrets. This flaw is a classic instance of CWE‑918 and can be leveraged to reach services that should be isolated from the internet.

All installations of MagicMirrorOrg MagicMirror running a version older than 2.36.0 are affected. Any deployment that has not yet applied the 2.36.0 patch is vulnerable.

The vulnerability scores a 9.2 on the CVSS scale, indicating critical severity. The EPSS score of 3% indicates a moderate likelihood of exploitation, and combined with the lack of authentication and a direct endpoint that can hit any URL, makes exploitation likely from remote attackers. The flaw is not listed in the CISA KEV catalog, but its impact is still significant due to the potential to access sensitive internal hosts and credentials.