EUVD-2026-24496Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects AT:P requirement (OIDC must be configured); I:L added for expired-token acceptance beyond vendor's availability-only score; no confidentiality impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.
AnalysisAI
Inverted time comparison logic in the Data Sharing Framework (DSF) OIDC cache layer creates two compounding defects in all versions prior to 2.1.0: the JWKS and Metadata Document caches never serve cached values, forcing a live HTTP fetch to the OIDC provider on every authenticated request, while the FHIR client token cache never expires entries, allowing revoked or expired OIDC tokens to be accepted indefinitely. Both conditions require OIDC bearer-token authentication or back-channel logout to be enabled on the DSF FHIR Server or BPE Server. No public exploit exists and SSVC confirms exploitation status as none, but the expired-token acceptance path represents a meaningful authentication integrity gap in deployments relying on token revocation.
Technical ContextAI
DSF is a Java-based distributed process engine built on BPMN 2.0 and FHIR R4, used in healthcare data sharing scenarios. The defect (CWE-670: Always-Incorrect Control Flow Implementation) manifests in two cache classes: BaseOidcClientWithCache (configuration and JWKS caches) and OidcClientWithCache (configuration, JWKS, and access token caches). In both, a ZonedDateTime comparison used isBefore where isAfter was required - a single-character logical inversion that inverts cache hit/miss semantics. The JWKS cache bug causes the condition 'cache entry is still valid' to always evaluate false, while the token cache bug causes 'token is expired' to always evaluate false. Affected CPEs include cpe:2.3:a:datasharingframework:dsf:*:*:*:*:*:*:*:*, cpe:2.3:a:dev.dsf:dsf-bpe-process-api-v2:*:*:*:*:*:*:*:*, and cpe:2.3:a:dev.dsf:dsf-bpe-server:*:*:*:*:*:*:*:*. The fix in commits 31c2e974d and d3ca59b4d corrects both comparisons and adds configurable cache timeouts.
RemediationAI
Upgrade to DSF 2.1.0, which corrects both cache comparison inversions in BaseOidcClientWithCache and OidcClientWithCache (commits 31c2e974d and d3ca59b4d). The fix also introduces configurable cache timeouts via dev.dsf.server.auth.oidc.provider.client.cache.timeout.configuration.resource and dev.dsf.server.auth.oidc.provider.client.cache.timeout.jwks.resource, defaulting to PT1H. Full details are in the GitHub Security Advisory at https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634. Before patching, operators can restart the BPE server to force-clear the stuck token cache, which temporarily restores correct token expiry behavior until the next expired token is cached. Disabling OIDC authentication entirely (reverting to mutual TLS) eliminates exposure from both defects but removes OIDC-dependent access control features. There is no partial workaround that addresses the JWKS cache miss path without patching.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today