CVE-2026-40942

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.

• CWE-670

• https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef
• https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908
• https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40935WWBN AVideo is an open source video platform. In versions 29…5.3
• CVE-2026-40937RustFS is a distributed object storage system built in Rust.…8.3
• CVE-2026-40938Tekton Pipelines project provides k8s-style resources for de…8.5
• CVE-2026-40939The Data Sharing Framework (DSF) implements a distributed pr…6.8
• CVE-2026-4094The FOX – Currency Switcher Professional for WooCommerce plu…8.1
• CVE-2026-40941Cacti is an open source performance and fault management fra…6.5
• CVE-2026-40943Oxia is a metadata store and coordination system. Prior to 0…8.7
• CVE-2026-40944Oxia is a metadata store and coordination system. Prior to 0…6.9
• CVE-2026-40945Oxia is a metadata store and coordination system. Prior to 0…8.7
• CVE-2026-40946Oxia is a metadata store and coordination system. Prior to 0…9.2
• CVE-2026-40947Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, an…2.9
• CVE-2026-40948The Keycloak authentication manager in `apache-airflow-provi…5.4