CVE-2026-65655: Temporal UI Server 2.7.0 to before 2.53.2

Affected technology

Temporal UI Server · 2.7.0 to before 2.53.2
Temporal Technologies, Inc.

Component: OIDC authentication cookies
File: server/auth/auth.go, server/route/auth.go

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

Expose that credential only if the attacker can also steer traffic for the UI hostname, prevent the browser's HTTPS connection from succeeding, serve the hostname over HTTP, and read a later same-site plaintext request. Vendor/CNA’s CVSS 4.0 assessment (base score 2.3/10) rates confidentiality and integrity impact as low; availability impact as none.