Prompts Chat CVE-2026-22665

Attacker requires an authenticated account on prompts.chat prior to commit 1464475. No victim interaction needed. Attacker creates case-variant usernames exploiting inconsistent case-sensitive/case-insensitive handling to bypass uniqueness checks and impersonate victim accounts or inject malicious content.

Real-world risk is moderate-to-high for platforms hosting user-generated content. The CVSS 8.6 score reflects genuine technical severity: network exploitation with low complexity and no user interaction makes this readily exploitable by any authenticated user (PR:L). However, impact is constrained to the vulnerable platform (SC:N/SI:N/SA:N indicate no subsequent system compromise). No EPSS score or KEV listing suggests limited current exploitation visibility, but the attack's simplicity (create case-variant account, monitor non-deterministic resolution) means manual exploitation requires minimal sophistication. Vendor patch availability (commit 1464475) eliminates technical barriers to remediation. Primary risk vectors include reputation damage from profile impersonation, SEO poisoning via canonical URL hijacking, and trust exploitation in community platforms where username identity anchors content authenticity. SSVC assessment: exploitation status is public (VulnCheck advisory), automatable with moderate effort (requires authenticated session establishment), technical impact is partial (user account takeover but not platform-wide compromise). Organizations running self-hosted prompts.chat instances should prioritize patching; users on hosted services depend on operator upgrade cycles.

An authenticated attacker registers username 'Alice' on prompts.chat after victim 'alice' already exists, exploiting case-insensitive validation bypass. The platform's non-deterministic user resolution randomly serves either profile when users navigate to /alice, allowing the attacker to poison the canonical URL with malicious prompt templates containing phishing links or misinformation. When search engines index the page during attacker-controlled resolution windows, the fraudulent content becomes associated with the victim's established reputation. Simultaneously, the attacker monitors resolution patterns to harvest victim profile views, extracting confidential prompt metadata. Attack requires only low-privilege authenticated access with no user interaction (CVSS PR:L/UI:N), making mass exploitation feasible through automated account creation scripts.