CVE-2026-39915: TIM Flow < 26.0.6 CRLF Injection via rt Parameter and access_token Cookie
TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter and accesstoken cookie, which are reflected into Set-Cookie response headers. Attackers can craft malicious requests to induce authenticated users to execute arbitrary JavaScript in their browser context, enabling session token theft and account credential modification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TIM Flowto a version that resolves this vulnerability.Fixed in 26.0.6 - Compensating control
Until upgrading past TIM Flow 26.0.6, mitigate CRLF header injection risk by adding an external WAF/proxy rule to block or sanitize requests containing carriage return/line feed (CR/LF; %0d/%0a) in the rt URL parameter and in the access_token cookie.
Event History
Frequently Asked Questions
Which deployments are affected?
TIM Flow versions before 26.0.6 are affected. The provided information does not state whether any particular configuration disables the vulnerable behavior.
What does an attacker need to exploit this issue?
An attacker can send crafted requests containing carriage return and line feed sequences in the rt URL parameter and access_token cookie. Exploitation requires an authenticated user to execute the resulting injected JavaScript in their browser context.
What is the likely impact if exploitation succeeds?
Injected response content can cause arbitrary JavaScript to run in an authenticated user's browser context. This can enable theft of session tokens and modification of account credentials.
What should be done to remediate the vulnerability?
Upgrade TIM Flow to version 26.0.6 or later. The provided information does not identify a workaround for environments where upgrading cannot be performed immediately.