CVE-2026-40939

MediumCVSS 6.8

Published: 21/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

In the Data Sharing Framework (DSF), OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired.

Risk Assessment

Unlimited session lifetime increases the risk of unauthorized access if a session is hijacked or a device is left unattended.

Recommendation

Update DSF to version 2.1.0 or later, which contains the fix.

Other vulnerabilities in Data Sharing Framework (DSF)

CVE-2026-40942Medium
Data Sharing Framework (DSF) prior to 2.1.0 has an inverted time comparison in the OIDC JWKS and Metadata Document caches, causing the cache to never return cached values and every request to trigger a fresh HTTP fetch. Additionally, the OIDC token cache for FHIR client connections uses an inverted time comparison, so it never invalidates and returns the same token even if expired.

Original NVD description (English source)

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This vulnerability is fixed in 2.1.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS