Read the docs
TI-2026-29593 Aliases CVE-2026-40942GHSA-xmj9-7625-f634

DSF: Inverted Time Comparison in OIDC JWKS and Token Cache

Priority LOW 28CWE-670Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Fix Fixed dsf (datasharingframework): 2.1.0dsf-bpe-process-api-v2 (dev.dsf): 2.1.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
datasharingframeworkdsfbefore 2.1.02.1.0Patch availableCNA
dev.dsfdsf-bpe-process-api-v2before 2.1.02.1.0Patch availableCNA
dev.dsfdsf-bpe-serverbefore 2.1.02.1.0Patch availableCNA
—dev.dsf:dsf-bpe-process-api-v2 (Maven)all versions—No fix listedGHSA-xmj9-7625-f634
—dev.dsf:dsf-bpe-server (Maven)all versions—No fix listedGHSA-xmj9-7625-f634
  • dsf Vendordatasharingframework Affected before 2.1.0 Fixed in 2.1.0 Patch available CNA
  • dsf-bpe-process-api-v2 Vendordev.dsf Affected before 2.1.0 Fixed in 2.1.0 Patch available CNA
  • dsf-bpe-server Vendordev.dsf Affected before 2.1.0 Fixed in 2.1.0 Patch available CNA
  • dev.dsf:dsf-bpe-process-api-v2 (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-xmj9-7625-f634
  • dev.dsf:dsf-bpe-server (Maven) Vendor— Affected all versions Fixed in — No fix listed GHSA-xmj9-7625-f634

Remediation

  • Fix · CNA dsf (datasharingframework) Fixed in 2.1.0
  • Fix · CNA dsf-bpe-process-api-v2 (dev.dsf) Fixed in 2.1.0
  • Fix · CNA dsf-bpe-server (dev.dsf) Fixed in 2.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40942
  2. 2026-10-03 Alias added: GHSA-xmj9-7625-f634

References

Advisory 1

Other 4

  • TI-2026-29591 DSF: Missing Session Timeout for OIDC Sessions CVSS 4.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences