PT-2026-34186 · Unknown · Data Sharing Framework

Published 2026-04-15 · Updated 2026-04-26 · CVE-2026-40942

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Data Sharing Framework (DSF) versions prior to 2.1.0

Description The Data Sharing Framework (DSF) implements a distributed process engine based on BPMN 2.0 and FHIR R4 standards. An inverted time comparison (using isBefore instead of isAfter) in the OIDC JWKS and Metadata Document caches prevents the system from returning cached values, forcing a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the provider for every request. Additionally, an inverted time comparison in the OIDC token cache for FHIR client connections prevents cache invalidation, resulting in the system returning the same OIDC token even after it has expired.

Recommendations Update to version 2.1.0.

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2026-40942

GHSA-XMJ9-7625-F634

Affected Products

Data Sharing Framework

References · 8

• https://osv.dev/vulnerability/GHSA-xmj9-7625-f634 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40942 · Security Note
• https://github.com/datasharingframework/dsf · Note
• https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634 · Note
• https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef · Note
• https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908 · Note
• https://twitter.com/CVEnew/status/2048481100121469000 · Twitter Post
• https://twitter.com/infoflowcloud/status/2048482363236135146 · Twitter Post