CVE-2026-22665

Description

prompts.chat prior to commit 1464475, contains an identity confusion vulnerability due to inconsistent case-sensitive and case-insensitive handling of usernames across write and read paths, allowing attackers to create case-variant usernames that bypass uniqueness checks. Attackers can exploit non-deterministic username resolution to impersonate victim accounts, replace profile content on canonical URLs, and inject attacker-controlled metadata and content across the platform.

Weakness classification

• disclosure@vulncheck.com: CWE-178

Primary references

• disclosure@vulncheck.com — Patch
• disclosure@vulncheck.com — Exploit, Issue Tracking, Vendor Advisory
• disclosure@vulncheck.com — Third Party Advisory