PT-2026-35189 · Maven · Dev.Dsf:Dsf-Bpe-Process-Api-V2+1
Published
2026-04-15
·
Updated
2026-04-15
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Affected Components
- DSF FHIR Server with enabled bearer-token authentication or back-channel logout.
- DSF BPE Server with enabled bearer-token authentication or back-channel logout.
- DSF BPE Server API v2 process plugins using FHIR client connections with configured OIDC authentication.
Summary
- The OIDC JWKS and Metadata Document caches used an inverted time comparison (
isBeforeinstead ofisAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. - The OIDC token cache for the FHIR client connections used an inverted time comparison (
isBeforeinstead ofisAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired.
Impact
- Performance: Every OIDC-authenticated request added network round-trips to the OIDC provider, increasing latency
- Reliability: Cached OIDC tokens become unusable after expiration and can only be invalidated by restart of the BPE. If the OIDC provider is temporarily unreachable, all requests fail immediately instead of using cached keys
- Load: Unnecessary load on the OIDC provider, potentially causing rate limiting
Fix (commits 31c2e974d, d3ca59b4d)
- Fixed cache timeout comparison from
isBeforetoisAfterinBaseOidcClientWithCache(configuration and JWKS caches) andOidcClientWithCache(configuration, JWKS, and access token caches) - Added configurable cache timeouts via
dev.dsf.server.auth.oidc.provider.client.cache.timeout.configuration.resourceanddev.dsf.server.auth.oidc.provider.client.cache.timeout.jwks.resource(default:PT1H)
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dev.Dsf:Dsf-Bpe-Process-Api-V2
Dev.Dsf:Dsf-Bpe-Server