Data Sharing Framework CVE-2026-40939
MEDIUMSeverity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access to the victim's browser is required (AV:P); the attacker needs no credentials of their own (PR:N); full read/write access to the victim's data scope (C:H/I:H); no availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This vulnerability is fixed in 2.1.0.
AnalysisAI
Indefinite OIDC session persistence in the Data Sharing Framework (DSF) FHIR and BPE servers prior to 2.1.0 allows any person with physical access to an authenticated browser session to access DSF resources under the original user's permissions, even after the OIDC access token has expired. The root cause is the absence of a maximum inactivity timeout in the Jetty-based session handler for OIDC browser sessions. No public exploit code exists and no active exploitation has been identified; EPSS stands at 0.02% (4th percentile), consistent with the physical access requirement.
Technical ContextAI
DSF is a Java/Maven-based distributed process engine built on the BPMN 2.0 workflow standard and the HL7 FHIR R4 interoperability standard, deployed in healthcare research networks. The affected Maven artifacts - dev.dsf:dsf-common-jetty, dev.dsf:dsf-fhir-server, and dev.dsf:dsf-bpe-server (all versions below 2.1.0) - use Eclipse Jetty as the embedded web server. When OIDC browser authentication is enabled, the Jetty SessionHandler was never configured with a maximum inactivity interval (setMaxInactiveInterval was absent), meaning server-side sessions survived indefinitely regardless of OIDC access token expiry. CWE-613 (Insufficient Session Expiration) precisely describes this: the application fails to invalidate server sessions after a reasonable idle period or after the underlying credential (access token) lapses. mTLS machine-to-machine communication is entirely unaffected; only interactive OIDC browser sessions are in scope.
RemediationAI
Upgrade to DSF 2.1.0, which introduces a configurable inactivity timeout via the property dev.dsf.server.auth.oidc.session.timeout (defaulting to PT30M, i.e. 30 minutes) and enforces logout when the OIDC ID token expires via logoutWhenIdTokenIsExpired(true). Websocket sessions are also now closed with a VIOLATED_POLICY signal upon credential expiry. The fix is implemented across commits f4ecb002f7d1 and 7d25feafb83d in the upstream repository. Until an upgrade can be performed, the most effective compensating control for shared-workstation deployments is enforcing a policy requiring explicit logout before leaving a workstation; this can be reinforced via browser session timeout policies or automatic screen-lock combined with session-clearing on lock. Note that this control relies on user compliance and does not address the underlying technical gap. Disabling OIDC browser authentication entirely in favor of mTLS-only access eliminates the attack surface but removes interactive UI access for human users.
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today