GHSA-xmj9-7625-f634
Medium · 5.3Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache
CVSS
5.3
EPSS
—
Published
Apr 15, 2026
CISA due date
—
The record
- The OIDC JWKS and Metadata Document caches used an inverted time comparison (`isBefore` instead of `isAfter`), causing the cache to **never return cached values**. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. - The OIDC token cache for the [FHIR client connections](https://dsf.dev/operations/v2.1.0/bpe/fhir-client-connections.html) used an inverted time comparison (`isBefore` instead of `isAfter`), causing the cache to **never invalidate**. Every incoming request returned the same OIDC token even if expired.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-40942 The Data Sharing Framework (DSF) implements a distributed process engine based on the… Same vulnerability
- CVE-2026-106586 In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to… CWE-670
- CVE-2026-98164 In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check… CWE-670
- CVE-2026-98051 In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix… CWE-670
- CVE-2026-55624 MintyItanium Lost-Auction is an auction plugin for Minecraft. CWE-670
- CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results… CWE-670
- CVE-2026-73283 In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to… CWE-670
- CVE-2026-20713 Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R)… CWE-670