Wyoming prior to version 1.10.2 allows unauthenticated network attackers to force outbound connections to arbitrary hosts by supplying a malicious `uri` query parameter to the HTTP API. The flaw enables the attacker to override the server‑configured backend and redirect connections to attacker‑chosen endpoints via `tcp://` or `unix://` URIs. Common Weakness Identifier CWE‑918 illustrates that the API incorrectly validates or sanitizes the supplied URI, exposing the service to Server‑Side Request Forgery.

The affected product is OHF‑Voice Wyoming, specifically any installation earlier than 1.10.2. Vulnerable API endpoints include /api/info, /api/speech-to-text, and /api/text-to-speech. Users running any pre‑1.10.2 release of Wyoming are at risk unless isolated or updated.

The CVSS score of 6.9 indicates moderate severity, while the lack of an EPSS score does not rule out current exploit activity. Attackers require only network access to the exposed API and no authentication. Successful exploitation can lead to unauthorized outbound connections, potentially exposing internal resources or enabling lateral movement. Although not listed in CISA’s KEV catalog, the vulnerability remains significant because it directly impacts server‑to‑server communication paths.