GHSA-m837-xvxr-vqwg: Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage

The TTS generation endpoint sets Access-Control-Allow-Origin: * as a hardcoded response header, independent of the server’s CORS configuration. This enables any webpage to make cross-origin requests to generate speech using stored credentials.