TI-2026-85047 CVE-2026-121936 · GHSA-5rpq-mc2h-94cc
Server-side request forgery in easyVoice via openaiBaseUrl in TTS API
Priority HIGH 70
easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled.