CVE-2026-63643: MagicMirror: ssrf calendar .js

The ADD_CALENDAR handler in calendar/node_helper.js performs a server-side HTTP request to a URL that is fully attacker-controlled, with no SSRF protection whatsoever — unlike the project’s hardened /cors endpoint.

Worse, the attacker also controls:

• the authentication headers the server attaches to the request (auth: { method: "bearer", pass: "..." });
• the selfSignedCert flag, which disables TLS verification of the server-side request.

When the target’s response is valid iCal, the server parses the events and sends them back to the attacker via CALENDAR_EVENTS — turning the SSRF into full data exfiltration (response body read). Against non-iCal responses it remains a blind SSRF (the attacker still forces the server-side request, they just don’t see the body).