TIM Flow CVE-2026-39915

Exploitation requires that the target user is authenticated to TIM Flow at the time they access the crafted URL - the attacker leverages the victim's existing authenticated session context to achieve high-impact outcomes (session theft, credential modification). The attack is delivered via the rt URL query parameter or the access_token cookie; the rt parameter vector is straightforwardly exploitable through a crafted link, while the access_token cookie vector would additionally require the attacker to influence cookie values, which is a higher bar. CVSS UI:A confirms active user interaction is mandatory - the victim must click or otherwise load the malicious URL; fully automated exploitation without victim interaction is not possible. No non-default server configuration is required; the vulnerability is present in default deployments of TIM Flow before 26.0.6 on any platform. Exploitation is limited to scenarios where attackers can deliver links to authenticated TIM Flow users, typically via phishing, spear-phishing, or embedding links in content the victim accesses while logged in.

The CVSS 4.0 base score of 8.5 with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N reflects a network-accessible, low-complexity attack requiring no privileges but mandating active user interaction - meaning the attacker must socially engineer an authenticated TIM Flow user into clicking a crafted link. The UI:A metric is the primary limiting factor dampening real-world exploitation likelihood below what a pure CVSS score implies. No EPSS data was provided in the intelligence set; absent that signal, probability of mass automated exploitation is structurally low given the user-interaction requirement. The vulnerability is not listed in the CISA KEV catalog, and no public POC has been referenced, further reducing near-term exploitation probability. However, the high confidentiality and integrity impact scores are credible - session token theft directly enables account takeover, and credential modification represents a persistent foothold. Organizations with authenticated users regularly exposed to phishing or malicious links (e.g., those receiving external communications that include TIM Flow links) face meaningful risk. No conflicting signals exist between the CVSS vector and description; the attack model is internally consistent.

An attacker identifies a TIM Flow instance and crafts a URL where the rt query parameter contains CRLF sequences followed by injected header content and a JavaScript payload in the response body. The attacker delivers this link via phishing email or message to an authenticated TIM Flow user; when the user clicks the link, their browser sends the request to the TIM Flow server, which reflects the unsanitized rt value into a Set-Cookie response header, splitting the response and injecting the attacker's JavaScript. The script executes in the victim's browser session, exfiltrating the session token to an attacker-controlled endpoint or silently modifying account credentials.