CVE-2026-40939 Details

A vulnerability exists in the Data Sharing Framework (DSF) versions prior to 2.1.0, specifically within the DSF FHIR Server and DSF BPE Server when OpenID Connect (OIDC) authentication is enabled. The issue arises because OIDC-authenticated sessions lacked a maximum inactivity timeout, allowing sessions to persist indefinitely after login, even after the OIDC access token had expired. This flaw could lead to unauthorized access, as another user could potentially use the same browser to access the DSF UI with the previous user's permissions. This vulnerability is particularly concerning in hospital environments with shared workstations, where it could be exploited to gain access to sensitive information or perform actions on behalf of the original user.

Users can upgrade to DSF version 2.1.0, which addresses this vulnerability by introducing a configurable session timeout for OIDC logins and tying session lifetime to the OIDC access token's validity. Instructions for upgrading to DSF 2.1.0 are available on the DSF website.