CVE-2026-40942

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef
https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908
https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634

Configurations

No configuration.

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El Data Sharing Framework (DSF) implementa un motor de procesos distribuido basado en los estándares BPMN 2.0 y FHIR R4. Antes de la versión 2.1.0, las cachés de OIDC JWKS y del Documento de Metadatos utilizaban una comparación de tiempo invertida (isBefore en lugar de isAfter), lo que provocaba que la caché nunca devolviera valores almacenados en caché. Cada solicitud entrante activaba una nueva recuperación HTTP del Documento de Metadatos de OIDC y las claves JWKS del proveedor de OIDC. La caché de tokens de OIDC para las conexiones de cliente FHIR utilizaba una comparación de tiempo invertida (isBefore en lugar de isAfter), lo que provocaba que la caché nunca se invalidara. Cada solicitud entrante devolvía el mismo token de OIDC incluso si estaba caducado. Esta vulnerabilidad está corregida en la versión 2.1.0.

Information

Published : 2026-04-21 22:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-40942

Mitre link : CVE-2026-40942

CVE.ORG link : CVE-2026-40942

JSON object : View

Products Affected

No product.

CWE

CWE-670

Always-Incorrect Control Flow Implementation

{"id": "CVE-2026-40942", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40942", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T17:52:51.070590Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "datasharingframework", "product": "dsf", "versions": [{"status": "affected", "version": "< 2.1.0"}]}, {"vendor": "dev.dsf", "product": "dsf-bpe-process-api-v2", "versions": [{"status": "affected", "version": "< 2.1.0"}]}, {"vendor": "dev.dsf", "product": "dsf-bpe-server", "versions": [{"status": "affected", "version": "< 2.1.0"}]}]}], "published": "2026-04-21T22:16:19.700", "references": [{"url": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef", "source": "security-advisories@github.com"}, {"url": "https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908", "source": "security-advisories@github.com"}, {"url": "https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-670"}]}], "descriptions": [{"lang": "en", "value": "The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0."}, {"lang": "es", "value": "El Data Sharing Framework (DSF) implementa un motor de procesos distribuido basado en los est\u00e1ndares BPMN 2.0 y FHIR R4. Antes de la versi\u00f3n 2.1.0, las cach\u00e9s de OIDC JWKS y del Documento de Metadatos utilizaban una comparaci\u00f3n de tiempo invertida (isBefore en lugar de isAfter), lo que provocaba que la cach\u00e9 nunca devolviera valores almacenados en cach\u00e9. Cada solicitud entrante activaba una nueva recuperaci\u00f3n HTTP del Documento de Metadatos de OIDC y las claves JWKS del proveedor de OIDC. La cach\u00e9 de tokens de OIDC para las conexiones de cliente FHIR utilizaba una comparaci\u00f3n de tiempo invertida (isBefore en lugar de isAfter), lo que provocaba que la cach\u00e9 nunca se invalidara. Cada solicitud entrante devolv\u00eda el mismo token de OIDC incluso si estaba caducado. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.1.0."}], "lastModified": "2026-10-26T22:10:00.163", "sourceIdentifier": "security-advisories@github.com"}