CVE-2026-22665

Katalog CVE

CVSS 8.1 · High EPSS 0,33%

Kerentanan Improper Handling of Case Sensitivity pada fka prompts.chat. Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

prompts.chat prior to commit 1464475, contains an identity confusion vulnerability due to inconsistent case-sensitive and case-insensitive handling of usernames across write and read paths, allowing attackers to create case-variant usernames that bypass uniqueness checks. Attackers can exploit non-deterministic username resolution to impersonate victim accounts, replace profile content on canonical URLs, and inject attacker-controlled metadata and content across the platform.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-178: Improper Handling of Case Sensitivity

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/f/prompts.chat/pull/1098 exploit · issue tracking · advisory vendor
• https://github.com/f/prompts.chat/commit/1464475df2698fb7ccd0cdbc382b0750466f891d patch
• https://www.vulncheck.com/advisories/prompts-chat-identity-confusion-via-case-sensitive-username-handling advisory pihak ketiga