Dsf Bpe Process Api V2
Monthly
Inverted time comparison logic in the Data Sharing Framework (DSF) OIDC cache layer creates two compounding defects in all versions prior to 2.1.0: the JWKS and Metadata Document caches never serve cached values, forcing a live HTTP fetch to the OIDC provider on every authenticated request, while the FHIR client token cache never expires entries, allowing revoked or expired OIDC tokens to be accepted indefinitely. Both conditions require OIDC bearer-token authentication or back-channel logout to be enabled on the DSF FHIR Server or BPE Server. No public exploit exists and SSVC confirms exploitation status as none, but the expired-token acceptance path represents a meaningful authentication integrity gap in deployments relying on token revocation.
Inverted time comparison logic in the Data Sharing Framework (DSF) OIDC cache layer creates two compounding defects in all versions prior to 2.1.0: the JWKS and Metadata Document caches never serve cached values, forcing a live HTTP fetch to the OIDC provider on every authenticated request, while the FHIR client token cache never expires entries, allowing revoked or expired OIDC tokens to be accepted indefinitely. Both conditions require OIDC bearer-token authentication or back-channel logout to be enabled on the DSF FHIR Server or BPE Server. No public exploit exists and SSVC confirms exploitation status as none, but the expired-token acceptance path represents a meaningful authentication integrity gap in deployments relying on token revocation.