CVE-2026-40942 Details
Description
The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.
A vulnerability exists in the Data Sharing Framework (DSF) versions prior to 2.1.0, specifically within the OIDC JWKS and Metadata Document cache mechanisms. The issue arises from an incorrect time comparison that prevents the caches from functioning properly. As a result, the OIDC Metadata Document and JWKS keys are fetched anew with each incoming request, rather than utilizing cached values. Additionally, the OIDC token cache for FHIR client connections fails to invalidate expired tokens, causing requests to return outdated tokens instead.
Users can update to version 2.1.0, where this vulnerability is fixed. Instructions for updating can be found in the DSF documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 21, 2026CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-670 | Always-Incorrect Control Flow Implementation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dev.dsf.dsf-bpe-server | All versions |
CPE
Remediation
| |
| dev.dsf.dsf-bpe-process-api-v2 | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |