CVE-2026-22664 is a server-side request forgery (SSRF) vulnerability in prompts.chat before commit 30a8f04. It arises from insufficient validation of URLs supplied in the token parameter used in Fal.ai media status polling. Authenticated attackers can exploit this to force the server to make arbitrary outbound HTTP requests, which can disclose sensitive authorization credentials (FAL_API_KEY) in request headers. This exposure enables credential theft, internal network probing, and abuse of the victim's Fal.ai account. The vulnerability is confirmed with a CVSS 4.0 score of 7.1 (high severity). There is no vendor advisory or patch information available at this time.

Successful exploitation allows authenticated users to perform arbitrary outbound requests from the server, exposing the FAL_API_KEY in the Authorization header. This can lead to theft of credentials, unauthorized access to internal network resources, and misuse of the victim's Fal.ai account. The impact is significant due to the potential for credential compromise and internal network reconnaissance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user access to the affected functionality if possible and monitor for suspicious activity related to outbound requests. Avoid supplying untrusted URLs in the token parameter. Follow vendor updates closely for an official fix.