When OAuth authentication is enabled and TLS terminates at a reverse proxy that forwards requests to Temporal UI Server over HTTP, the server derives the Secure attribute of authentication cookies from the proxy-to-server connection. This can result in access-token and refresh-token cookies being issued without the Secure attribute despite the browser completing login over HTTPS. Exploitation requires an attacker to control traffic for the UI hostname, block HTTPS connections, serve the hostname over HTTP, and read same-site plaintext requests. The vulnerability allows replay of recovered credentials within the victim's permissions, with refresh-token replay depending on identity provider behavior. Effective HSTS, HTTPS-only warnings, or TLS re-encryption between proxy and server prevent the demonstrated attack path.

An attacker who can manipulate network traffic and serve the Temporal UI hostname over HTTP may capture authentication cookies lacking the Secure attribute, potentially allowing replay of access and refresh tokens within the victim's permissions. However, exploitation requires multiple conditions including control over traffic and blocking HTTPS connections. A malicious website alone cannot read the cookies, and passive network observation is insufficient. The overall impact is limited by these conditions and the low CVSS score reflects this.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation includes ensuring TLS is re-encrypted between the reverse proxy and Temporal UI Server or configuring effective HSTS and HTTPS-only warnings to prevent downgrade to HTTP. Avoid terminating TLS at a proxy that forwards to the server over HTTP without secure cookie handling. These measures prevent the demonstrated disclosure path.