CVE-2026-39915

Name of the Vulnerable Software and Affected Versions TIM Flow versions prior to 26.0.6

Description Remote attackers can perform CRLF injection—a technique used to insert carriage return and line feed characters into a stream—by embedding unsanitized sequences in the rt URL parameter and the access token cookie. These inputs are reflected into Set-Cookie response headers, allowing the injection of arbitrary HTTP headers and response body content. This can be used to induce authenticated users to execute arbitrary JavaScript in their browser context, potentially leading to session token theft and account credential modification.

Recommendations Update TIM Flow to version 26.0.6 or later. Avoid using the rt URL parameter and the access token cookie until the update is applied.