{"id":"CVE-2026-40942","summary":"DSF: Inverted Time Comparison in OIDC JWKS and Token Cache","details":"The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider. The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired. This vulnerability is fixed in 2.1.0.","aliases":["GHSA-xmj9-7625-f634"],"modified":"2026-08-12T16:24:09.296620Z","published":"2026-04-21T21:09:44.537Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40942.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-670"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40942.json"},{"type":"ADVISORY","url":"https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40942"},{"type":"FIX","url":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef"},{"type":"FIX","url":"https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/datasharingframework/dsf","events":[{"introduced":"0"},{"fixed":"31c2e974dfd4351756104ee8c53dbcd666192fef"},{"fixed":"d3ca59b4daccde16a006fedeccce28fd1f826908"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.1.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40942.json","vanir_signatures_modified":"2026-08-12T16:24:09Z","vanir_signatures":[{"digest":{"line_hashes":["317088013271472183219481532280969116446","276904826500374669336067116081088939684","249555369688947269500113846801954015933","252844721699133585690006153402034307642"],"threshold":0.9},"id":"CVE-2026-40942-0352ed50","signature_type":"Line","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908","target":{"file":"dsf-bpe/dsf-bpe-server/src/main/java/dev/dsf/bpe/client/oidc/OidcClientWithCache.java"},"deprecated":false},{"target":{"file":"dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfOpenIdLoginService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["15568848578052994891429983013012251376","43159017572274552714755172207459353163","269178039507918343337586965745267559124","319372185822665214366295475367771573133","43241233356432250636359869808301954374","119186917048813680169370639929902825357","62965861604109236527167068483677437112","38563699726889113450555607803388759487","187690798981999844543093377096338380650","186573594167232885317210859332473823177","203521895707097567638506170861765026300","40715596247243532356271389363889594155","179326421917097929783787137891522430331","60716131381620679439955124683777784989","83923278370468985389378890818889465329","197274117933264281433404370761614852235","3434690827652148165398257650163650893","240021198362606694441206557823760847647","140326788696311854021101447038668233356","242526978429542541654030571914318134613","213506837224235478568506420187315196237","295576366731679647086010018511752453234"]},"id":"CVE-2026-40942-05e693ba","signature_type":"Line","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef"},{"signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/test/java/dev/dsf/common/oidc/JwksTest.java"},"deprecated":false,"digest":{"line_hashes":["273847697527872029590377879008996033639","174233230544383623345949099706241518588","236190796031340185150225781452498448231","87007281969190608769983146267672819030","272976641737575018738264163168862332444","339506121077393912595238848362188755298","205963882551840992448112829200753075168","167889051907145159947153898625682508851","116208612723762138937018089271749303885","210745551569549694231187646846664950485","314406726805378212360087299085189608732","133779206795028512109835708860495986585","124802786350483773095799030584057696165","284862078982213950353494642382451606446","316975167570256202082783029220459951475","219806781450409619565067739577449430112","101507885581505111869269518706442598530","70216443357201417391975401338314597734","50501235614528612655699154190041239932","220826145480749802464491464064398239917","267601877696182350241468815642322172681","257140742654090928830009978243678948206","149980895757357477491724344589483384021","264699565953311885911128318902909269937","102482014334052641116438577555484958496","254083983981919250510779727503217274839","292654378924375817779616191410338799045","92413991063154353200119168523310502670"],"threshold":0.9},"id":"CVE-2026-40942-0713d963","signature_type":"Line"},{"source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/Jwks.java","function":"toEcdsaAlgorithm"},"deprecated":false,"digest":{"function_hash":"269544564271300008458992242859623858860","length":370},"id":"CVE-2026-40942-0cccd655","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-40942-19ebfcf0","signature_type":"Function","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/config/AbstractJettyConfig.java","function":"baseOidcClient"},"deprecated":false,"digest":{"function_hash":"305487121917248760570450265857387274401","length":579}},{"target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/BaseOidcClientWithCache.java","function":"getJwks"},"deprecated":false,"digest":{"function_hash":"42835899269875704591123452575690868843","length":122},"id":"CVE-2026-40942-2cc30a9e","signature_type":"Function","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef"},{"deprecated":false,"digest":{"line_hashes":["333148744811694858349774189492033557904","268341932966300194453604725301097745253","307906164747368637184153615915649492094","66165236401896768315577558863051811632","91432464406612966728098772307696579618","99712127604643822756010155036421295687","183844472983899076103243660002642667386","178535935044257550160224239472309161668","111841727471929898239849813893976778521","99176738170149682275278789671646907256","11411559198146165848917718123426585635","258436804150374241867369851500833160165","339243390642360616097522642542541886002","146305125201995731872955998902736801584","287486597562380535836083048830101074488","254118428216406260872581626877657258380","189889298203746964346111955809768545321","116484648289259667242044494192994718732","43061754937112951923412209650125481557","320956679592046105050594899469404869260","260876243659621131576606791682107662565","31281968098380524628652678749619592761"],"threshold":0.9},"id":"CVE-2026-40942-474b0447","signature_type":"Line","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/config/AbstractJettyConfig.java"}},{"signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/config/AbstractJettyConfig.java","function":"oidcProviderClientTimeoutConnect"},"deprecated":false,"digest":{"function_hash":"243056218280266436269758914950621305231","length":61},"id":"CVE-2026-40942-514a9ccb","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"188753325443308831186934973015713059338","length":367},"id":"CVE-2026-40942-616c7fd9","signature_type":"Function","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/Jwks.java","function":"toRsaAlgorithm"}},{"target":{"file":"dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/config/AbstractJettyConfig.java","function":"oidcProviderClientTimeoutRead"},"deprecated":false,"digest":{"function_hash":"243056218280266436269758914950621305231","length":61},"id":"CVE-2026-40942-6ad9bcfe","signature_type":"Function","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef"},{"source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"function":"DsfOpenIdLoginService","file":"dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfOpenIdLoginService.java"},"deprecated":false,"digest":{"function_hash":"129426151254647273901259682851530375936","length":114},"id":"CVE-2026-40942-6e271795","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-40942-752aa528","signature_type":"Function","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/BaseOidcClientWithCache.java","function":"getConfiguration"},"deprecated":false,"digest":{"function_hash":"14425153368676086807068873698678772603","length":112}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/JwtVerifierImpl.java","function":"verifyBearerToken"},"deprecated":false,"digest":{"function_hash":"258373810382009443934128993717116388851","length":578},"id":"CVE-2026-40942-76f3473e"},{"deprecated":false,"digest":{"line_hashes":["131454095259758857264512343298941144885","108617182526472699759798335603947169708","102570644205834998261250556883698751801","326948339199145679728629150421048096013","202095943440167113173723275400613627141","36552857933893094667143411685465852428","237537661534317861219137762863368183687","193549001139398214820403189830164716277","5049383620856976608388217093493071763","23193355412366731940007718242098410782","19886625087442163110488880805879387138","257584570505667617006696443572166983700","286921850425293736375070006280898834870","326948339199145679728629150421048096013","103957401969311390215740634975738671237","291563161152747307001157050951681431173","46616004157871171436510237003914503294","114493504031879222422835863772635041165","96302037565074933794422264943813112327","220993698795766857382012225602887256247","24829897893069070814350953400940803842","19886625087442163110488880805879387138","13442695039811083286880294789267233828"],"threshold":0.9},"id":"CVE-2026-40942-7c261a85","signature_type":"Line","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/JwtVerifierImpl.java"}},{"deprecated":false,"digest":{"function_hash":"43505672358120312570075749668239778650","length":922},"id":"CVE-2026-40942-84fbff2c","signature_type":"Function","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"function":"toEcPublicKey","file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/Jwks.java"}},{"signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/BaseOidcClientWithCache.java"},"deprecated":false,"digest":{"line_hashes":["25590341219750107018012854813949293209","293305896017090633247526424034581907345","131398227730165696843900774943919802444","137515965865777805250947172735408769842","82667946570039877071505646057536667933","58500201270406060991037144103324688164","178205026392251379874116136340656053904","232764799432302181813351073911548746097","157189259020381828505272754596988660146","17847038971409292417426261145654516683","173780937677262440081389507373463872798","193544397796566805665144173057991604562","139164874785018838655586675538623302521","209980485335905573980318926582757251078","69922937827076475504990936043271784585","123609889497091903425890723901173599632","228407354623848609264580821110113596708","177574009793047201813007564298967295973","143690168451758076152333777789353218768","146532535030365270251763815345207405622","263466385801201483282431646332847654282","32784522808108266758776225681463761829","113802150879542737856742648345810925844","2206187097887444822011345870609379927","28962255081716106392044578299886592512","139068914493774734508749305269137084494","249418504584197375795824811855662100398","34141513637404549615573965800611705143","275652355744457188002916005169486836796","305592421478124200523156088563567749302","126489716227095196048837854439761430595","74424989723216589729208896279545247404","14709488867249551216742991330230159844","223229763712917265640429145803528130688","275140996287704234279019588723080521355","106154708011402359840238265600141217854"],"threshold":0.9},"id":"CVE-2026-40942-855528c3","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"216234956438159974427994195348320934680","length":459},"id":"CVE-2026-40942-8e3cf7d1","signature_type":"Function","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/Jwks.java","function":"toRsaPublicKey"}},{"source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/BaseOidcClientWithCache.java","function":"getOrSet"},"deprecated":false,"digest":{"function_hash":"144358380249501260963747875813868249072","length":245},"id":"CVE-2026-40942-915f399b","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/Jwks.java","function":"toAlgorithm"},"deprecated":false,"digest":{"length":224,"function_hash":"318861258138654671492361474763866254415"},"id":"CVE-2026-40942-9ab32d69","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["160682523899115658207840472752274385908","101393176527487548177588553009465361756","279624775213303607433957235400200405630","181132969223289428863332659074765886005","310567919020435291962969873526265593876","74115263256007076634805985659843368198","195994878474433770130459664063033392005","167892977448287646290756462276760492286","1859398004198039087540088092437282029","299597574193431435648471629814140952242","59937095874216510213090255845715962342","41048008673527057925116465357925118621","333978443571711300653148509718057435545","16815033579170564839969580145201281077","210466001665605854508182148302275750907","72239824749113581042098226598997363748","202602170658841954835624010137092596722","268965078604146725858004960424941468591","92154391749221315654526124832653692441","161488582803140306990982035322114986614","200221933299551321637871832317616809794","52469659346200867543109506318714337818","4795466054453322138657511854943937525","282011501526619558031831972415833847078","23305941888139963829220269006512934175","131873902559592237915899339986556058106","107260441903075111427361804762923446184","125513238995689963193458732613735449748","181190111245051728078618490947323401076","2363120655349415237717466003703243156","100542002266177140230930016951538005627","117377197584465238996414432872712930136","45615673256594824330974000326404614855","288282002181868390430952504366594850936","221421780918615576418151644265749790930","323748894476784917736095611560493225495","150318164901063451239684901948859699152","246159210433933694155620748047392482058","287487877318838730326538526449054193202","150242196835136392216264129116679351315","324349948422874812874185465987670850964","239133191855841541554591365484048134084","147670719850897000091280564846005118218","302752077883934335933495859372332387193","326226549581446966318176395009918281435","286064206620853613897991486053265144893","332899145051963763610862661459387163779","25736290172404974190630061008520444214","14953389811394424680309209342223473684","182273674985936618793092611871378865874","287143071781745610363415628019733667812","56623542026336830447317115085392210813","207798684611150004100454731866838305081","299472434299813019617537189345894428391","255010711427693055264632658720998536387","132568249850367635022116321452529875344","252814668733445524045975207555345874170","87708657704896509412351799720403068100","175255892076558326118464915885573071738"],"threshold":0.9},"id":"CVE-2026-40942-a22842e2","signature_type":"Line","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/Jwks.java"}},{"source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/BaseOidcClientWithCache.java","function":"BaseOidcClientWithCache"},"deprecated":false,"digest":{"function_hash":"336566084769378629583412291952624904128","length":87},"id":"CVE-2026-40942-a24ab6c3","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"125618843681554142517622163432996550233","length":441},"id":"CVE-2026-40942-ad573881","signature_type":"Function","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfOpenIdLoginService.java","function":"login"},"deprecated":false},{"digest":{"line_hashes":["3622605943292791725074610860518931287","222094587727060358370839318537644905283","166932660026477436220196946507838283819","40343384325823932899405897226083639185","101050812012279205513376312873626406971","141541894357981044572319866058479379853","81028889702117917585972638037764614006","183177946579178628853177306955106815262","337913179777600434519899449300115785329","52772741914156365311679580152134213834","279350670604489873445927030722430707102","65414636468268560710896183752728240970","107037846612905438260474431381195943346","219814098287114801136989488337221317017","9071511947880439279450630909843344461","321759882655220498980213519097206279099","195400708882464073831754471684722417822","110049240402989120552062508638155398158","271419005161436326968673754394598033026","27829893898019936470131875995934112287","66485126744932853228478707779226249719","332173732307791524351960641727781726467","266884394911079379731024953154532285837","31112741330224706353241215183523782209","260166040367829907007507377108308034950","187580043915881055042934055647830451546","180037162913910745570292921582413350525","83972455095728762057173570056759421628"],"threshold":0.9},"id":"CVE-2026-40942-addff741","signature_type":"Line","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-bpe/dsf-bpe-server/src/main/java/dev/dsf/bpe/client/oidc/OidcClientWithCache.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"58479888561879259464777863865123414927","length":1015},"id":"CVE-2026-40942-ae36f4d1","signature_type":"Function","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-common/dsf-common-oidc/src/test/java/dev/dsf/common/oidc/JwksTest.java","function":"testDecodeJwks"}},{"deprecated":false,"digest":{"line_hashes":["51478542357719129166591557117196874183","332500555294929071937173014262631693432","319204786648862896313870834782776420678","83782952613277963788234783580268433360","14587644061513922823844018035687722255","32982452083835476439874302154488956304","339917528411722132346418333773248023706","195550020266526916029224213653267686217","309941629325684980397627036363632704255","191736777480790452859937267395713219689","273336188276821196124189995441007189773","43421343702651715511083339401955845836","278791004976980384961812598281840299435","282135850895955449329431105090192295467","200432714594593056507361679240848644432","332646055368383785955402195931840834860","23153910722609021488079532887424559288"],"threshold":0.9},"id":"CVE-2026-40942-b3698655","signature_type":"Line","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-bpe/dsf-bpe-server/src/main/java/dev/dsf/bpe/client/oidc/OidcClientJersey.java"}},{"target":{"file":"dsf-common/dsf-common-oidc/src/main/java/dev/dsf/common/oidc/JwtVerifierImpl.java","function":"verifyBackchannelLogout"},"deprecated":false,"digest":{"function_hash":"8730890164913953833835947263830226869","length":614},"id":"CVE-2026-40942-d8554ade","signature_type":"Function","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef"},{"digest":{"function_hash":"243644730393010463717944192067547327392","length":1826},"id":"CVE-2026-40942-da398eff","signature_type":"Function","signature_version":"v1","source":"https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef","target":{"file":"dsf-bpe/dsf-bpe-server/src/main/java/dev/dsf/bpe/client/oidc/OidcClientJersey.java","function":"verifyAndDecodeAccessToken"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}