This vulnerability arises from the TTS API's openaiBaseUrl parameter. When useLLM is enabled, the backend forwards the supplied URL in a POST request, allowing an attacker to instruct the server to contact arbitrary hosts, including loopback endpoints. The server replies with error messages in the x-generate-tts-warning header, which attackers can use to confirm the reachability of internal IPs and ports.

Vendor cosin2077’s easyVoice application versions earlier than 0.0.23 are affected. Any deployed instance using a pre‑0.0.23 release that exposes the /api/v1/tts endpoint is vulnerable.

The CVSS score is 6.9, indicating a medium severity. The issue is unauthenticated and does not require privileged access, making it easy for an attacker to try requests. Because the service does not restrict outbound traffic, the attacker can use the endpoint to probe internal networks and potentially reach sensitive services. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the lack of authentication makes it a notable risk for organizations that expose the backend to untrusted networks.