CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue access-token cookies, and refresh-token cookies when provided by the identity provider, without Secure even though the browser completed login over HTTPS. A victim who visits attacker-controlled content while a credential remains live may expose that credential only if the attacker can also steer traffic for the UI hostname, prevent the browser's HTTPS connection from succeeding, serve the hostname over HTTP, and read a later same-site plaintext request. A malicious website alone cannot read the cookie, and passive observation of a successful TLS connection is insufficient. Effective HSTS, a blocking HTTPS-only warning, or TLS re-encryption between the proxy and Temporal UI Server prevents the demonstrated disclosure path. A recovered credential may be replayed within the victim's assigned permissions. Refresh-token replay additionally depends on the identity provider's issuance, expiry, rotation, and reuse-detection behavior.

• CWE-614

• https://github.com/temporalio/ui-server/blob/v2.53.1/server/auth/auth.go#L87-L153
• https://github.com/temporalio/ui-server/blob/v2.53.1/server/route/auth.go#L281-L316
• https://github.com/temporalio/ui-server/commit/7b9ff533fb51beba75497c0a192c66775c08f279
• https://github.com/temporalio/ui-server/commit/821cf598371353f1b579dfe1e87aeb3638b041d6
• https://github.com/temporalio/ui-server/commit/8876b80b63003688ab736f45ef28885695a4f6db
• https://github.com/temporalio/ui-server/releases/tag/v2.53.1
• https://github.com/temporalio/ui-server/releases/tag/v2.53.2
• https://github.com/temporalio/ui/pull/3806

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6563A vulnerability has been found in H3C Magic B1 up to 100R004…8.8
• CVE-2026-65635Improper Isolation or Compartmentalization vulnerability in …8.3
• CVE-2026-65636Improper Neutralization of CRLF Sequences vulnerability in u…2.1
• CVE-2026-6564A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0…4.3
• CVE-2026-6565The Style Kits – Advanced Theme Styles for Elementor, Elemen…6.4
• CVE-2026-65650Elgg before 7.0.0 does not check image dimensions to prevent…4.3
• CVE-2026-65656Improper neutralization of special elements used in a comman…7.8
• CVE-2026-65657Use after free in Microsoft Office allows an unauthorized at…7.8
• CVE-2026-65658Deserialization of untrusted data in Microsoft Office ShareP…8.8
• CVE-2026-6566The Photo Gallery, Sliders, Proofing and Themes – NextGEN Ga…4.3
• CVE-2026-65660Improper control of generation of code ('code injection') in…6.5
• CVE-2026-65661Heap-based buffer overflow in Microsoft Office allows an una…7.8