CVE-2026-39915: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in TIM Solutions TIM Flow

CVE-2026-39915 is a CRLF injection vulnerability in TIM Solutions' TIM Flow product prior to version 26.0.6. The vulnerability arises from improper neutralization of carriage return and line feed sequences in the rt URL parameter, which is reflected into the Set-Cookie HTTP response headers. Exploitation allows remote attackers to inject arbitrary HTTP headers and response body content, potentially leading to HTTP response splitting attacks. This can cause authenticated users to execute attacker-controlled JavaScript in their browser context, facilitating session token theft and unauthorized account modifications.

Successful exploitation can lead to arbitrary HTTP header injection and response splitting, resulting in cross-site scripting (XSS) attacks against authenticated users. This enables attackers to steal session tokens and modify account credentials, compromising user accounts and potentially allowing unauthorized access.

A fix is available in TIM Flow version 26.0.6. Users should upgrade to version 26.0.6 or later to remediate this vulnerability. Patch status is confirmed by the affectedVersions data indicating versions before 26.0.6 are vulnerable. No vendor advisory content was provided, so check the vendor's official channels for the patch and additional guidance.