PT-2026-33385 · Unknown · Data Sharing Framework

Published 2026-04-15 · Updated 2026-04-26 · CVE-2026-40939

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Data Sharing Framework versions prior to 2.1.0

Description OIDC-authenticated sessions lack a configured maximum inactivity timeout, allowing sessions to persist indefinitely after login, even after the OIDC access token has expired. This allows a different person using the same browser to access the UI with the previous user's permissions if the user did not explicitly log out, which is a significant risk in environments with shared workstations. This issue specifically affects OIDC browser sessions and does not impact mTLS machine-to-machine communication.

Recommendations Update to version 2.1.0. Configure the session timeout using the dev.dsf.server.auth.oidc.session.timeout variable. Enable logoutWhenIdTokenIsExpired(true) in the OpenID configuration to link session lifetime to token lifetime.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-40939

GHSA-GJ7P-595X-QWF5

Affected Products

Data Sharing Framework

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-40939 · Security Note
• https://osv.dev/vulnerability/GHSA-gj7p-595x-qwf5 · Vendor Advisory
• https://github.com/datasharingframework/dsf/commit/7d25feafb83d66cb59985ac88568b67d937b1937 · Note
• https://github.com/datasharingframework/dsf/security/advisories/GHSA-gj7p-595x-qwf5 · Note
• https://github.com/datasharingframework/dsf/commit/f4ecb002f7d12642f92da6b79371ed367d0140e7 · Note
• https://github.com/datasharingframework/dsf · Note
• https://dsf.dev/operations/v2.1.0/bpe/oidc.html · Note
• https://twitter.com/infoflowcloud/status/2048482387638485429 · Twitter Post
• https://twitter.com/CVEnew/status/2048481101589389682 · Twitter Post
• https://dsf.dev/operations/v2.1.0/fhir/oidc.html · Note