When OAuth authentication is enabled on Temporal UI Server and a TLS‑terminating reverse proxy forwards the callback to the server over HTTP, affected versions derive the Secure attribute of authentication cookies from the proxy‑to‑server connection rather than the browser‑facing HTTPS connection. Consequently, access‑token and refresh‑token cookies can be set without the Secure flag, making them transmittable over unencrypted HTTP and susceptible to capture if an attacker can serve the UI hostname over HTTP.

Temporal Technologies, Inc. – Temporal UI Server versions prior to 2.53.2 are affected. The fix is included in v2.53.2 and later. Specific vulnerability applies to the authentication handler code responsible for cookie attribute determination.

Based on the description, it is inferred that attackers would need to control traffic to the UI hostname, prevent the browser’s HTTPS connection from succeeding, serve the hostname over HTTP, and be able to read a later same‑site plaintext request to capture the cookie. The CVSS score of 2.3 indicates a low overall risk, and the EPSS score of less than 1% shows a very low likelihood of exploitation. Attackers would also need to replay recovered credentials within the victim’s permissions, with replay of refresh tokens additionally depending on the identity provider’s issuance, expiry, rotation, and reuse‑detection behavior. The vulnerability is not listed in the CISA KEV catalog. Mitigating controls such as enforcing HSTS, blocking plaintext HTTP, or ensuring TLS encryption between the reverse proxy and Temporal UI Server remove the disclosure path even though they do not correct the configuration‑dependent cookie attribute.