CRLF Injection Vulnerability in TIM Flow by TIM

CVE-2026-39915

What is CVE-2026-39915?

The TIM Flow application prior to version 26.0.6 has a vulnerability allowing attackers to exploit carriage return and line feed sequences in the 'rt' URL parameter and 'access_token' cookie. By crafting requests with these unsanitized characters, attackers can inject arbitrary HTTP headers and content into the response. This can lead to serious security implications, including the execution of malicious JavaScript in the user's browser context. Consequently, this vulnerability facilitates session token theft and unauthorized modifications to account credentials, posing a significant risk to user data integrity and web application security.

References