CVE-2026-121936 easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API

easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...