CVE-2026-40942

The record

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.

Affected packages

Related vulnerabilities

• GHSA-xmj9-7625-f634 Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache Same vulnerability
• CVE-2026-106586 In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to… CWE-670
• CVE-2026-98164 In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check… CWE-670
• CVE-2026-98051 In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix… CWE-670
• CVE-2026-55624 MintyItanium Lost-Auction is an auction plugin for Minecraft. CWE-670
• CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results… CWE-670
• CVE-2026-73283 In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to… CWE-670
• CVE-2026-20713 Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R)… CWE-670