Prompts Chat CVE-2026-22664

Requires authenticated user account on prompts.chat prior to commit 30a8f04. Attacker must supply attacker-controlled URL in the token parameter of Fal.ai media status polling endpoint. No victim interaction needed. Exploits lack of URL validation in outbound request handling.

The CVSS 4.0 score of 7.1 reflects high confidentiality impact (VC:H) with network attack vector (AV:N), low attack complexity (AC:L), and low privilege requirements (PR:L). The vulnerability requires authentication, which reduces the immediate attack surface compared to unauthenticated SSRF flaws. However, the real-world risk is elevated by multiple factors: the vulnerability enables direct credential theft (FAL_API_KEY exfiltration), not just information disclosure; SSRF can pivot to internal network reconnaissance in cloud environments; and stolen API keys enable ongoing abuse of victim Fal.ai accounts for resource consumption or further attacks. EPSS data was not provided, and no CISA KEV listing exists, indicating no confirmed active exploitation at time of analysis. The availability of proof-of-concept code in the VulnCheck advisory (referenced GitHub gist) significantly lowers the barrier to exploitation. From an SSVC perspective: exploitation status is POC-available, automatable once credentials are obtained, with high technical impact due to credential compromise. Organizations using prompts.chat should prioritize patching despite the authentication requirement, as insider threats or compromised user accounts could immediately weaponize this for API key theft.

An authenticated attacker with valid prompts.chat credentials crafts a malicious request to the Fal.ai media status polling endpoint, injecting a token parameter containing a URL pointing to an attacker-controlled server (e.g., https://attacker.example.com/capture). When the vulnerable prompts.chat server processes this request, it makes an HTTP request to the attacker's URL with the FAL_API_KEY included in the Authorization header. The attacker's server captures the API key from the incoming request headers, then uses the stolen credentials to access the victim's Fal.ai account for resource abuse or further attacks. Additionally, the attacker can probe internal network resources by supplying URLs like http://169.254.169.254/latest/meta-data/ to extract cloud instance metadata or http://internal-service:8080/ to map internal infrastructure, all while appearing as legitimate traffic from the trusted prompts.chat server.