Product
TIM Flow versions prior to 26.0.6 contain a CRLF injection vulnerability allowing attackers to inject arbitrary HTTP headers and perform session theft via XSS.