TI-2026-70698 CVE-2026-108719 · GHSA-c996-f546-j683Blind SSRF in LLMGateway via video-generation callback_urlPriority LOW 24LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callback_url extension.CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00282 · Published 2026-10-11 · No fix listed CWE-918