CVE-2026-22665: Fka Prompts.chat

High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days.

prompts.chat prior to commit 1464475, contains an identity confusion vulnerability due to inconsistent case-sensitive and case-insensitive handling of usernames across write and read paths, allowing attackers to create case-variant usernames that bypass uniqueness checks. Attackers can exploit non-deterministic username resolution to impersonate victim accounts, replace profile content on canonical URLs, and inject attacker-controlled metadata and content across the platform.

Affected products

• Fka Prompts.chat: before 2026-03-24 (fixed in 2026-03-24)

Published 2026-04-03. Last modified 2026-07-24.