CVE-2026-39915: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in TIM Solutions TIM Flow
TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers. Attackers can craft malicious requests to induce authenticated users to execute arbitrary JavaScript in their browser context, enabling session token theft and account credential modification.
AI Analysis
Technical Summary
CVE-2026-39915 is a CRLF injection vulnerability in TIM Solutions' TIM Flow product prior to version 26.0.6. The flaw arises from improper neutralization of carriage return and line feed sequences in the rt URL parameter and access_token cookie, which are reflected into Set-Cookie response headers. This allows remote attackers to craft malicious requests that inject arbitrary HTTP headers and response body content, leading to HTTP request/response splitting. The exploitation can cause authenticated users to execute attacker-controlled JavaScript, risking session token theft and credential modification.
Potential Impact
Successful exploitation can lead to HTTP response splitting attacks, enabling attackers to inject arbitrary HTTP headers and response content. This can cause authenticated users to execute arbitrary JavaScript in their browsers, potentially resulting in session token theft and unauthorized modification of account credentials.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time.
CVE-2026-39915: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in TIM Solutions TIM Flow
Description
TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers. Attackers can craft malicious requests to induce authenticated users to execute arbitrary JavaScript in their browser context, enabling session token theft and account credential modification.
CVSS v4.0
Score 8.5high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-39915 is a CRLF injection vulnerability in TIM Solutions' TIM Flow product prior to version 26.0.6. The flaw arises from improper neutralization of carriage return and line feed sequences in the rt URL parameter and access_token cookie, which are reflected into Set-Cookie response headers. This allows remote attackers to craft malicious requests that inject arbitrary HTTP headers and response body content, leading to HTTP request/response splitting. The exploitation can cause authenticated users to execute attacker-controlled JavaScript, risking session token theft and credential modification.
Potential Impact
Successful exploitation can lead to HTTP response splitting attacks, enabling attackers to inject arbitrary HTTP headers and response content. This can cause authenticated users to execute arbitrary JavaScript in their browsers, potentially resulting in session token theft and unauthorized modification of account credentials.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-04-07T20:57:06.209Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8c53b1acd9273b49a6bf05
Added to database: 08/24/2026, 14:22:41 UTC
Last enriched: 08/24/2026, 14:37:21 UTC
Last updated: 08/24/2026, 15:37:55 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.