Dsf
Monthly
Inverted time comparison logic in the Data Sharing Framework (DSF) OIDC cache layer creates two compounding defects in all versions prior to 2.1.0: the JWKS and Metadata Document caches never serve cached values, forcing a live HTTP fetch to the OIDC provider on every authenticated request, while the FHIR client token cache never expires entries, allowing revoked or expired OIDC tokens to be accepted indefinitely. Both conditions require OIDC bearer-token authentication or back-channel logout to be enabled on the DSF FHIR Server or BPE Server. No public exploit exists and SSVC confirms exploitation status as none, but the expired-token acceptance path represents a meaningful authentication integrity gap in deployments relying on token revocation.
Indefinite OIDC session persistence in the Data Sharing Framework (DSF) FHIR and BPE servers prior to 2.1.0 allows any person with physical access to an authenticated browser session to access DSF resources under the original user's permissions, even after the OIDC access token has expired. The root cause is the absence of a maximum inactivity timeout in the Jetty-based session handler for OIDC browser sessions. No public exploit code exists and no active exploitation has been identified; EPSS stands at 0.02% (4th percentile), consistent with the physical access requirement.
Inverted time comparison logic in the Data Sharing Framework (DSF) OIDC cache layer creates two compounding defects in all versions prior to 2.1.0: the JWKS and Metadata Document caches never serve cached values, forcing a live HTTP fetch to the OIDC provider on every authenticated request, while the FHIR client token cache never expires entries, allowing revoked or expired OIDC tokens to be accepted indefinitely. Both conditions require OIDC bearer-token authentication or back-channel logout to be enabled on the DSF FHIR Server or BPE Server. No public exploit exists and SSVC confirms exploitation status as none, but the expired-token acceptance path represents a meaningful authentication integrity gap in deployments relying on token revocation.
Indefinite OIDC session persistence in the Data Sharing Framework (DSF) FHIR and BPE servers prior to 2.1.0 allows any person with physical access to an authenticated browser session to access DSF resources under the original user's permissions, even after the OIDC access token has expired. The root cause is the absence of a maximum inactivity timeout in the Jetty-based session handler for OIDC browser sessions. No public exploit code exists and no active exploitation has been identified; EPSS stands at 0.02% (4th percentile), consistent with the physical access requirement.