CVE-2026-22664 is a server-side request forgery vulnerability (CWE-918) in prompts.chat prior to commit 30a8f04. It affects the Fal.ai media status polling functionality by allowing authenticated users to supply arbitrary URLs in the token parameter. Due to lack of URL validation, the server performs outbound requests to attacker-controlled destinations, which can disclose the FAL_API_KEY included in the Authorization header. This exposure risks credential theft, internal network reconnaissance, and unauthorized use of the Fal.ai account associated with the application. The vulnerability has a CVSS 4.0 score of 7.1 (high severity). There is no vendor advisory or patch link available at this time, and the product is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows an authenticated attacker to perform arbitrary outbound requests from the vulnerable server, potentially disclosing sensitive credentials (FAL_API_KEY). This can lead to credential theft, unauthorized access to internal network resources, and abuse of the victim's Fal.ai account. The impact is significant given the high CVSS score and the sensitive nature of the leaked API key.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user access to trusted parties only and monitor for unusual outbound requests originating from the Fal.ai media status polling feature. Avoid exposing the vulnerable version in production environments where possible.