CVE-2026-121936

MEDIUM 6.5

easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflected error messages in the x-generate-tts-warning header to probe internal hosts and ports.

CWE	CWE-918
Vendor	cosin2077
Product	easyvoice
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for cosin2077 easyvoice

Be the first to know when new medium vulnerabilities affecting cosin2077 easyvoice are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

cosin2077 / easyVoice

0 < 0.0.23

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/cosin2077/easyVoice/issues/87 github.com: https://github.com/cosin2077/easyVoice/pull/88 github.com: https://github.com/cosin2077/easyVoice/commit/82fcb5b2f324c84b3f1808b29c6f44df16ccd42e github.com: https://github.com/cosin2077/easyVoice/releases/tag/v0.0.23 github.com: https://github.com/cosin2077/easyVoice/blob/be08c5f3fed07f3af749defcf04e590ffcb0c48d/packages/backend/src/utils/ssrf.ts#L28-L47 vulncheck.com: https://www.vulncheck.com/advisories/easyvoice-before-0.0.23-ssrf-via-openaibaseurl-in-tts-api

Credits

George Chen