CVE-2026-40942— DSF: Inverted Time Comparison in OIDC JWKS and Token Cache
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-40942
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DSF: Inverted Time Comparison in OIDC JWKS and Token Cache
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
控制流实现总是不正确
Source: NVD (National Vulnerability Database)
Vulnerability Title
Data Sharing Framework 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Data Sharing Framework是Data Sharing Framework开源的一个基于BPMN和FHIR的分布式医疗数据共享与处理框架。 Data Sharing Framework 2.1.0之前版本存在安全漏洞，该漏洞源于OIDC与FHIR缓存机制中错误地使用了反向时间比较逻辑。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| datasharingframework | dsf | < 2.1.0 | - | |
| dev.dsf | dsf-bpe-process-api-v2 | < 2.1.0 | - | |
| dev.dsf | dsf-bpe-server | < 2.1.0 | - |
II. Public POCs for CVE-2026-40942
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40942
请登录查看更多情报信息。
IV. Related Vulnerabilities
V. Comments for CVE-2026-40942
No comments yet