Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-65655— Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

Quick assessment

Affected
Temporal Technologies, Inc. Temporal UI Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

temporal.io ui-server是temporal.io组织的一款工作流编排平台的界面管理服务器。 temporal.io ui-server 2.7.0版本至2.53.2之前版本存在会话机制问题漏洞，该漏洞源于OAuth认证回调通过HTTP转发时，认证cookie的Secure属性未正确设置，可能导致访问令牌和刷新令牌cookie缺少Secure属性，进而导致用户凭据泄露。

CVSS 2.3 · Low EPSS 0.37% · P29

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle

Affected Version Matrix 1

VendorProduct Version RangeStatus
Temporal Technologies, Inc. Temporal UI Server 2.7.0< 2.53.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-65655

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy
Source: CVE Program / CVE List V5
Vulnerability Description
When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue access-token cookies, and refresh-token cookies when provided by the identity provider, without Secure even though the browser completed login over HTTPS. A victim who visits attacker-controlled content while a credential remains live may expose that credential only if the attacker can also steer traffic for the UI hostname, prevent the browser's HTTPS connection from succeeding, serve the hostname over HTTP, and read a later same-site plaintext request. A malicious website alone cannot read the cookie, and passive observation of a successful TLS connection is insufficient. Effective HSTS, a blocking HTTPS-only warning, or TLS re-encryption between the proxy and Temporal UI Server prevents the demonstrated disclosure path. A recovered credential may be replayed within the victim's assigned permissions. Refresh-token replay additionally depends on the identity provider's issuance, expiry, rotation, and reuse-detection behavior.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTPS会话中未设置’Secure’属性的敏感Cookie
Source: CVE Program / CVE List V5
Vulnerability Title
temporal.io ui-server 会话机制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
temporal.io ui-server是temporal.io组织的一款工作流编排平台的界面管理服务器。 temporal.io ui-server 2.7.0版本至2.53.2之前版本存在会话机制问题漏洞，该漏洞源于OAuth认证回调通过HTTP转发时，认证cookie的Secure属性未正确设置，可能导致访问令牌和刷新令牌cookie缺少Secure属性，进而导致用户凭据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Temporal Technologies, Inc. Temporal UI Server 2.7.0 ~ 2.53.2 -

II. Public POCs for CVE-2026-65655

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-65655

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-65655 (2)

Vendor Pages for CVE-2026-65655 (1)

IV. Related Vulnerabilities

Same vendor: Temporal Technologies, Inc.
Same weakness: CWE-614

V. Comments for CVE-2026-65655

No comments yet

Leave a comment