Skip to content
OpenAdvisories
Medium · 6.3 CVE-2026-40942 EUVD-2026-24496GHSA-xmj9-7625-f634

DSF: Inverted Time Comparison in OIDC JWKS and Token Cache

Published Apr 21, 2026 · Updated Apr 22, 2026 · Assigned by GitHub_M

Description

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.

Affected products

VendorProductAffectedFixed
datasharingframework dsf < 2.1.0 —
dev.dsf dsf-bpe-process-api-v2 < 2.1.0 —
dev.dsf dsf-bpe-server < 2.1.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven dev.dsf:dsf-bpe-process-api-v2 all versions — GHSA-xmj9-7625-f634
Maven dev.dsf:dsf-bpe-server all versions — GHSA-xmj9-7625-f634

References