CVE-2026-22665

Summary

prompts.chat prior to commit 1464475, contains an identity confusion vulnerability due to inconsistent case-sensitive and case-insensitive handling of usernames across write and read paths, allowing attackers to create case-variant usernames that bypass uniqueness checks. Attackers can exploit non-deterministic username resolution to impersonate victim accounts, replace profile content on canonical URLs, and inject attacker-controlled metadata and content across the platform.

Affected Software

VendorProductVersion RangeStatus
fprompts.chat0 < 1464475df2698fb7ccd0cdbc382b0750466f891daffected

Weaknesses

  • CWE-178: CWE-178 Improper Handling of Case Sensitivity

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References