CVE-2026-40942

MediumCVSS 6.3

Published: 21/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

22th percentile - higher than 22% of all known CVEs

Summary

Data Sharing Framework (DSF) prior to 2.1.0 has an inverted time comparison in the OIDC JWKS and Metadata Document caches, causing the cache to never return cached values and every request to trigger a fresh HTTP fetch. Additionally, the OIDC token cache for FHIR client connections uses an inverted time comparison, so it never invalidates and returns the same token even if expired.

Risk Assessment

Increased load on the OIDC provider and potential performance and security issues due to use of expired tokens.

Recommendation

Update DSF to version 2.1.0, which fixes this vulnerability.

Other vulnerabilities in Data Sharing Framework (DSF)

CVE-2026-40939Medium
In the Data Sharing Framework (DSF), OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired.

Original NVD description (English source)

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS