Inverted Time Comparison Issue in Data Sharing Framework by Data Sharing Framework
CVE-2026-40942
What is CVE-2026-40942?
The Data Sharing Framework (DSF) exhibits a vulnerability due to an incorrect implementation of time comparisons in its caching mechanism for OpenID Connect (OIDC) JSON Web Key Set (JWKS) and Metadata Documents. Prior to version 2.1.0, this flaw resulted in the cache failing to return valid cached values, leading to every incoming request triggering a new HTTP fetch of the required documents. Furthermore, the OIDC token cache used in FHIR client connections suffered from similar issues, where expired tokens were repeatedly returned due to the same flawed comparison logic. This could potentially compromise session security by allowing the reuse of invalidated tokens. The issue has been addressed in version 2.1.0.
Affected Version(s)
dsf < 2.1.0
dsf-bpe-process-api-v2 < 2.1.0
dsf-bpe-server < 2.1.0