TIM Flow before version 26.0.6 contains a CRLF injection flaw that allows a remote attacker to insert arbitrary carriage-return and line-feed characters into the rt URL parameter. The unsanitized input is reflected into Set‑Cookie response headers, enabling the injection of additional HTTP headers and response body content. Attackers can therefore embed malicious JavaScript that runs in the victim’s browser, leading to session‑token theft and the ability to modify account credentials. The weakness is classified as CWE‑113, indicating the improper handling of CRLF sequences in HTTP requests and responses.

The vulnerability impacts the TIM Solutions TIM Flow product with all releases prior to version 26.0.6; any environment deploying those versions is susceptible.

The CVSS score of 8.5 marks this issue as high severity. EPSS information is not provided, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote: an attacker constructs a malicious HTTP request containing CRLF characters in the rt parameter and directs an authenticated user to the target URL. Once the victim’s browser processes the compromised Set‑Cookie header, attacker‑controlled JavaScript executes, allowing credential theft or modification. The lack of an official workaround means the only reliable defense is to upgrade or patch the product to a version that removes the unsanitized rt parameter handling.