easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflected error messages in the x-generate-tts-warning header to probe internal hosts and ports.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Cosin2077
  • Easyvoice

No data.

No data.

References
Link Providers
https://github.com/cosin2077/easyVoice/blob/be08c5f3fed07f3af749defcf04e590ffcb0c48d/packages/backend/src/utils/ssrf.ts#L28-L47 cve-icon cve-icon
https://github.com/cosin2077/easyVoice/commit/82fcb5b2f324c84b3f1808b29c6f44df16ccd42e cve-icon cve-icon
https://github.com/cosin2077/easyVoice/issues/87 cve-icon cve-icon cve-icon
https://github.com/cosin2077/easyVoice/pull/88 cve-icon cve-icon
https://github.com/cosin2077/easyVoice/releases/tag/v0.0.23 cve-icon cve-icon
https://www.vulncheck.com/advisories/easyvoice-before-0.0.23-ssrf-via-openaibaseurl-in-tts-api cve-icon cve-icon
History

Fri, 06 Nov 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Cosin2077
Cosin2077 easyvoice
Vendors & Products Cosin2077
Cosin2077 easyvoice

Wed, 04 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 04 Nov 2026 12:45:00 +0000

Type Values Removed Values Added
Description easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflected error messages in the x-generate-tts-warning header to probe internal hosts and ports.
Title easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-11-04T12:31:16.408Z

Updated: 2026-11-04T18:56:27.814Z

Reserved: 2026-11-04T12:05:31.887Z

Link: CVE-2026-121936

cve-icon Vulnrichment

Updated: 2026-11-04T18:56:23.991Z

cve-icon NVD

Status : Received

Published: 2026-11-04T13:17:27.703

Modified: 2026-11-04T19:17:33.683

Link: CVE-2026-121936

cve-icon Redhat

No data.