Temporal Server versions prior to the fix do not bind workflow-history pagination tokens to the namespace and workflow named in the request. This allows an authenticated caller with read permission on one namespace to use a pagination token issued for a workflow in a different namespace to retrieve that workflow's history, provided the workflow identifiers map to the same history shard. The token is unauthenticated and can be manipulated to advance event ranges, potentially exposing history events beyond the caller's current permissions. Detection is difficult as affected versions emit no logs or metrics for this condition. Fixed versions add binding checks and emit logs and metrics when mismatches occur.