CVE-2026-39915: TIM Flow CRLF Injection XSS Vulnerability

CVE-2026-39915 Overview

CVE-2026-39915 is a Carriage Return Line Feed (CRLF) injection vulnerability in TIM Flow versions before 26.0.6. The flaw resides in the handling of the rt URL parameter, which is reflected into Set-Cookie response headers without sanitization. Remote attackers can embed CRLF sequences to inject arbitrary HTTP headers and response body content. This enables HTTP response splitting attacks that execute JavaScript in an authenticated user's browser context. Successful exploitation leads to session token theft and account credential modification. The vulnerability is classified under CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers.

Critical Impact
Remote attackers can hijack authenticated sessions and modify account credentials by tricking users into visiting crafted URLs.

Affected Products

TIM Flow versions prior to 26.0.6
Deployments exposing the rt URL parameter in authenticated workflows
Web clients consuming TIM Flow HTTP responses

Discovery Timeline

2026-08-24 - CVE-2026-39915 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-39915

Vulnerability Analysis

The vulnerability stems from improper neutralization of CRLF (\r\n) sequences in user-controlled input. TIM Flow accepts the rt query parameter and echoes its value into the Set-Cookie response header. Because the application does not strip or encode carriage return and line feed characters, an attacker can terminate the header early and append arbitrary HTTP headers or a new response body.

This behavior is a classic HTTP response splitting condition. An attacker crafts a URL containing encoded CRLF sequences followed by injected headers and HTML content. When an authenticated user follows the link, the browser interprets the injected content as legitimate output from the application. The attacker can then execute JavaScript within the trusted origin, read session cookies, and issue authenticated requests to change account credentials.

Root Cause

The root cause is missing input validation on the rt parameter before insertion into an HTTP response header. The application does not filter %0d and %0a byte sequences, nor does it reject values containing header delimiters. This maps directly to CWE-113.

Attack Vector

Exploitation requires network access to the TIM Flow web interface and user interaction with a crafted link. An attacker delivers a malicious URL through phishing, chat, or a compromised page. When an authenticated victim clicks the link, the server returns a response containing attacker-controlled headers and body. The injected JavaScript runs in the application's origin, granting access to session tokens and authenticated API endpoints.

The vulnerability does not require attacker authentication but does require victim interaction. See the VulnCheck Advisory: TIM Flow CRLF Injection for additional technical detail.

Detection Methods for CVE-2026-39915

Indicators of Compromise

HTTP requests to TIM Flow endpoints containing %0d%0a, %0D%0A, or raw CR/LF bytes in the rt query parameter
Access log entries showing unusually long rt values or URL-encoded HTTP header names such as Content-Type or Set-Cookie
Unexpected Set-Cookie headers or duplicate response headers in proxy or WAF logs
Client-side reports of unexpected redirects or credential prompts after clicking TIM Flow links

Detection Strategies

Inspect web server and reverse proxy logs for CRLF encoding patterns in query strings targeting TIM Flow
Deploy WAF rules that block requests containing %0d, %0a, or literal CR/LF sequences in URL parameters
Correlate anomalous session token usage from new IP addresses shortly after users access TIM Flow URLs

Monitoring Recommendations

Enable full HTTP request logging on TIM Flow front-end servers, including query strings and response header sizes
Monitor for account credential changes that follow closely after outbound clicks on TIM Flow links
Alert on browser console errors and Content Security Policy (CSP) violations sourced from TIM Flow origins

How to Mitigate CVE-2026-39915

Immediate Actions Required

Upgrade TIM Flow to version 26.0.6 or later as documented in the Atlassian Release Notes
Inventory all TIM Flow deployments and confirm the running build version
Restrict network exposure of TIM Flow to trusted networks or VPN users until patching completes
Rotate session tokens and force reauthentication after applying the fix

Patch Information

The vendor addressed the CRLF injection in TIM Flow 26.0.6 by sanitizing the rt parameter before it is reflected into response headers. Refer to the Atlassian Release Notes for upgrade instructions and the VulnCheck Advisory: TIM Flow CRLF Injection for technical validation of the fix.

Workarounds

Deploy a WAF rule that rejects HTTP requests containing %0d, %0a, \r, or \n byte sequences in the rt parameter
Configure the reverse proxy to strip or reject query parameters exceeding expected length or containing header delimiters
Enforce a strict Content Security Policy that blocks inline script execution on TIM Flow responses
Educate users to avoid clicking untrusted TIM Flow links until patching is verified

bash

# Example NGINX rule to block CRLF sequences in the rt parameter
if ($args ~* "(^|&)rt=[^&]*(%0d|%0a|\r|\n)") {
    return 400;
}