Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M
CVE-2026-40942DSF: Inverted Time Comparison in OIDC JWKS and Token Cache
Medium 6.3
In plain English
A medium-severity security flaw in dsf from datasharingframework. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | dev.dsf:dsf-bpe-process-api-v2 | no fix listed | GHSA-xmj9-7625-f634 |
| Maven | dev.dsf:dsf-bpe-server | no fix listed | GHSA-xmj9-7625-f634 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| datasharingframework | dsf | < 2.1.0 |
| dev.dsf | dsf-bpe-process-api-v2 | < 2.1.0 |
| dev.dsf | dsf-bpe-server | < 2.1.0 |
Weakness: CWE-670 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634 x_refsource_CONFIRM
- https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef x_refsource_MISC
- https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908 x_refsource_MISC