6 matches found
CVE-2026-121936
easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...
EUVD-2026-116893
easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...
CVE-2026-121936 easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API
easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...
CVE-2026-121936
The easyVoice software (versions prior to 0.0.23 ) is vulnerable to a Server-Side Request Forgery (SSRF) . An unauthenticated attacker can force the server to send POST requests by supplying a custom openaiBaseUrl while useLLM is enabled. This vulnerability can be exploited via the /api/v1/tts en...
CVE-2026-121936: cosin2077 easyVoice: easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to…
easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...
PT-2026-136956
easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflect...