CVE-2026-40942

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40942", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-15T20:40:15.519Z", "datePublished": "2026-04-21T21:09:44.537Z", "dateUpdated": "2026-04-22T18:11:33.794Z"}, "containers": {"cna": {"title": "DSF: Inverted Time Comparison in OIDC JWKS and Token Cache", "problemTypes": [{"descriptions": [{"cweId": "CWE-670", "lang": "en", "description": "CWE-670: Always-Incorrect Control Flow Implementation", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634"}, {"name": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef", "tags": ["x_refsource_MISC"], "url": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef"}, {"name": "https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908", "tags": ["x_refsource_MISC"], "url": "https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908"}], "affected": [{"vendor": "datasharingframework", "product": "dsf", "versions": [{"version": "< 2.1.0", "status": "affected"}]}, {"vendor": "dev.dsf", "product": "dsf-bpe-process-api-v2", "versions": [{"version": "< 2.1.0", "status": "affected"}]}, {"vendor": "dev.dsf", "product": "dsf-bpe-server", "versions": [{"version": "< 2.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T21:09:44.537Z"}, "descriptions": [{"lang": "en", "value": "The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0."}], "source": {"advisory": "GHSA-xmj9-7625-f634", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T17:52:51.070590Z", "id": "CVE-2026-40942", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:11:33.794Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40942", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T17:52:51.070590Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:09:06.207Z"}}], "cna": {"title": "DSF: Inverted Time Comparison in OIDC JWKS and Token Cache", "source": {"advisory": "GHSA-xmj9-7625-f634", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "datasharingframework", "product": "dsf", "versions": [{"status": "affected", "version": "< 2.1.0"}]}, {"vendor": "dev.dsf", "product": "dsf-bpe-process-api-v2", "versions": [{"status": "affected", "version": "< 2.1.0"}]}, {"vendor": "dev.dsf", "product": "dsf-bpe-server", "versions": [{"status": "affected", "version": "< 2.1.0"}]}], "references": [{"url": "https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634", "name": "https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef", "name": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908", "name": "https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-670", "description": "CWE-670: Always-Incorrect Control Flow Implementation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T21:09:44.537Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40942", "state": "PUBLISHED", "dateUpdated": "2026-04-22T18:11:33.794Z", "dateReserved": "2026-04-15T20:40:15.519Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-21T21:09:44.537Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dsf", "vendor": "datasharingframework", "versions": [{"status": "affected", "version": "< 2.1.0"}]}, {"product": "dsf-bpe-process-api-v2", "vendor": "dev.dsf", "versions": [{"status": "affected", "version": "< 2.1.0"}]}, {"product": "dsf-bpe-server", "vendor": "dev.dsf", "versions": [{"status": "affected", "version": "< 2.1.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0."}, {"lang": "es", "value": "El Data Sharing Framework (DSF) implementa un motor de procesos distribuido basado en los est\u00e1ndares BPMN 2.0 y FHIR R4. Antes de la versi\u00f3n 2.1.0, las cach\u00e9s de OIDC JWKS y del Documento de Metadatos utilizaban una comparaci\u00f3n de tiempo invertida (isBefore en lugar de isAfter), lo que provocaba que la cach\u00e9 nunca devolviera valores almacenados en cach\u00e9. Cada solicitud entrante activaba una nueva recuperaci\u00f3n HTTP del Documento de Metadatos de OIDC y las claves JWKS del proveedor de OIDC. La cach\u00e9 de tokens de OIDC para las conexiones de cliente FHIR utilizaba una comparaci\u00f3n de tiempo invertida (isBefore en lugar de isAfter), lo que provocaba que la cach\u00e9 nunca se invalidara. Cada solicitud entrante devolv\u00eda el mismo token de OIDC incluso si estaba caducado. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.1.0."}], "id": "CVE-2026-40942", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40942", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T17:52:51.070590Z", "version": "2.0.3"}}]}, "published": "2026-04-21T22:16:19.700", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef"}, {"source": "security-advisories@github.com", "url": "https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908"}, {"source": "security-advisories@github.com", "url": "https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-670"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dsf", "source": "cna", "vendor": "datasharingframework"}, "product": "dsf", "vendor": "datasharingframework"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dsf-bpe-process-api-v2", "source": "cna", "vendor": "dev.dsf"}, "product": "dsf-bpe-process-api-v2", "vendor": "dev.dsf"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dsf-bpe-server", "source": "cna", "vendor": "dev.dsf"}, "product": "dsf-bpe-server", "vendor": "dev.dsf"}], "analysis": {"en": {"generated_at": "2026-04-22T07:26:48.195943+00:00", "value": {"mitigation_remediation": ["Upgrade the Data Sharing Framework to version 2.1.0 or later and deploy the release to all affected instances.", "Restart the DSF services after upgrading to clear any stale in\u2011memory caches and ensure fresh fetches of OIDC metadata and JWKS keys.", "Revoke or regenerate OIDC tokens for all clients to force them to obtain fresh, valid tokens from the provider."], "summary": {"action": "Patch Immediately", "impact": "Authentication Bypass via Stale OIDC Tokens"}, "threat_synthesis": {"affected_systems": "This flaw affects the Data Sharing Framework by datasharingframework, specifically the dsf\u2011bpe\u2011process\u2011api\u2011v2 and dsf\u2011bpe\u2011server components. All releases older than 2.1.0 are vulnerable; 2.1.0 and later include the fix.", "description_and_impact": "The Data Sharing Framework implements caching for OIDC JWKS, metadata, and token values. In versions before 2.1.0 the logic used an inverted time comparison, causing cached entries to never be regarded as valid and, for the token cache, never to be invalidated. As a result, each request triggers a fetch of the OIDC metadata and JWKS keys, and every request is served with the same expired token. An attacker can exploit this flaw by simply continuing to send requests, thereby maintaining unauthorized access with tokens that should have been rejected. The core weakness is a misuse of time comparison, identified as CWE\u2011670.", "risk_and_exploitability": "The CVSS score of 6.3 classifies the issue as moderate. The vulnerability is exploitable over remote HTTP traffic to DSF services. No EPSS data is available and the issue is not listed in the CISA KEV catalog, so known exploitation is not documented. Nevertheless, any party able to issue repeated requests can leverage the expired\u2011token reuse to gain authorized data access or potentially elevate privileges."}}}}, "created": "2026-04-22T07:30:11.594139+00:00", "updated": "2026-04-22T11:45:02.700025+00:00", "vendors": ["datasharingframework", "datasharingframework$PRODUCT$dsf", "dev.dsf", "dev.dsf$PRODUCT$dsf-bpe-process-api-v2", "dev.dsf$PRODUCT$dsf-bpe-server"]}