CVE-2026-22664: Fka Prompts.chat

High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days.

prompts.chat prior to commit 30a8f04 contains a server-side request forgery vulnerability in the Fal.ai media status polling feature that allows authenticated users to perform arbitrary outbound requests by supplying attacker-controlled URLs in the token parameter. Attackers can exploit the lack of URL validation to disclose the FAL_API_KEY in the Authorization header, enabling credential theft, internal network probing, and abuse of the victim's Fal.ai account.

Affected products

• Fka Prompts.chat: before 2026-03-25 (fixed in 2026-03-25)

Published 2026-04-03. Last modified 2026-07-24.