CVE-2026-40942
Cache Logic Flaws in DSF OIDC Components Cause Token and Metadata Issues
Publication date: 2026-04-21
Last updated on: 2026-04-21
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-670 | The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Data Sharing Framework (DSF) prior to version 2.1.0. It involves incorrect time comparisons in caching mechanisms for OIDC JWKS and Metadata Document caches, as well as the OIDC token cache for FHIR client connections.
Specifically, the caches used an inverted time comparison (using isBefore instead of isAfter), which caused the JWKS and Metadata Document caches to never return cached values, forcing a fresh HTTP fetch on every request.
Additionally, the OIDC token cache never invalidated tokens because of the same inverted time comparison, causing every request to return the same OIDC token even if it was expired.
This flaw was fixed in version 2.1.0 of the DSF.
How can this vulnerability impact me? :
Because the JWKS and Metadata Document caches never return cached values, every incoming request triggers a fresh HTTP fetch from the OIDC provider, which can lead to increased latency and higher load on the OIDC provider.
More critically, the OIDC token cache never invalidates expired tokens, meaning that expired tokens may be accepted and reused, potentially allowing unauthorized access or session continuation beyond intended expiration.
This can lead to security risks such as unauthorized access to protected resources or data, and performance degradation due to excessive network requests.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in version 2.1.0 of the Data Sharing Framework (DSF). To mitigate this vulnerability, you should upgrade your DSF installation to version 2.1.0 or later.