CVE-2026-121936
Received Received - Intake

Server-Side Request Forgery in easyVoice Before 0.0.23

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflected error messages in the x-generate-tts-warning header to probe internal hosts and ports.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121936
EUVD
EUVD-2026-116893

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cosin2077 easyVoice 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-121936 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in easyVoice before version 0.0.23. When the useLLM setting is enabled, attackers can supply a custom OpenAI-compatible endpoint via the openaiBaseUrl parameter. The server then sends unauthorized POST requests to internal or loopback services through the /api/v1/tts endpoints. Error messages in the x-generate-tts-warning header reveal internal network details, enabling attackers to probe hosts and ports.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized POST requests originating from the easyVoice server, particularly to loopback or internal IP addresses. Check logs for requests to /api/v1/tts endpoints with custom openaiBaseUrl parameters. Use tools like curl to test if the server sends requests to internal hosts: curl -X POST http://<easyvoice-server>/api/v1/tts/create -H 'openaiBaseUrl: http://127.0.0.1' -H 'useLLM: true'.

Impact Analysis

This vulnerability allows unauthenticated attackers to force the easyVoice server to connect to internal services, including loopback addresses and private networks. Attackers can probe for open ports, gather network configuration details, and potentially access sensitive endpoints. The reflected error messages may act as a port-scanning tool, exposing internal infrastructure.

Compliance Impact

This SSRF vulnerability could lead to unauthorized network reconnaissance and potential data exfiltration, violating confidentiality requirements in GDPR and HIPAA. Exposure of internal network details via error messages may also breach data protection principles by revealing system configurations.

Mitigation Strategies

Immediately upgrade easyVoice to version 0.0.23 or later. Disable the useLLM feature if not required. Set ALLOW_PRIVATE_OPENAI_URL=false to enforce default-deny for private URLs. Block outbound requests to internal IP ranges at the firewall level. Review and sanitize error messages to avoid exposing internal network details.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121936. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...