CVE-2026-39915

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers. Attackers can craft malicious requests to induce authenticated users to execute arbitrary JavaScript in their browser context, enabling session token theft and account credential modification.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes
https://www.vulncheck.com/advisories/tim-flow-crlf-injection-via-rt-parameter

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) TIM Flow anterior a 26.0.6 contiene una vulnerabilidad de inyección CRLF que permite a atacantes remotos inyectar encabezados HTTP arbitrarios y contenido del cuerpo de la respuesta al incrustar secuencias de retorno de carro y salto de línea no saneadas en el parámetro URL 'rt', que se refleja en los encabezados de respuesta Set-Cookie. Los atacantes pueden elaborar solicitudes maliciosas para inducir a usuarios autenticados a ejecutar JavaScript arbitrario en el contexto de su navegador, lo que permite el robo de tokens de sesión y la modificación de credenciales de cuenta.

Information

Published : 2026-08-24 15:16

Updated : 2026-10-12 15:10

NVD link : CVE-2026-39915

Mitre link : CVE-2026-39915

CVE.ORG link : CVE-2026-39915

JSON object : View

Products Affected

No product.

CWE

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

{"id": "CVE-2026-39915", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39915", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T16:24:34.272261Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "TIM Solutions", "product": "TIM Flow", "versions": [{"status": "affected", "version": "0", "lessThan": "26.0.6", "versionType": "semver"}], "defaultStatus": "affected"}]}], "published": "2026-08-24T15:16:38.090", "references": [{"url": "https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/tim-flow-crlf-injection-via-rt-parameter", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-113"}]}], "descriptions": [{"lang": "en", "value": "TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers. Attackers can craft malicious requests to induce authenticated users to execute arbitrary JavaScript in their browser context, enabling session token theft and account credential modification."}, {"lang": "es", "value": "TIM Flow anterior a 26.0.6 contiene una vulnerabilidad de inyecci\u00f3n CRLF que permite a atacantes remotos inyectar encabezados HTTP arbitrarios y contenido del cuerpo de la respuesta al incrustar secuencias de retorno de carro y salto de l\u00ednea no saneadas en el par\u00e1metro URL 'rt', que se refleja en los encabezados de respuesta Set-Cookie. Los atacantes pueden elaborar solicitudes maliciosas para inducir a usuarios autenticados a ejecutar JavaScript arbitrario en el contexto de su navegador, lo que permite el robo de tokens de sesi\u00f3n y la modificaci\u00f3n de credenciales de cuenta."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "disclosure@vulncheck.com"}