Every CVE Search/ Get API key

CVE-2026-40939

DSF: Missing Session Timeout for OIDC Sessions

6.8 MediumFix available

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This vulnerability is fixed in 2.1.0.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.15%Up 0.1 points since Apr 22, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.8

DSF: Missing Session Timeout for OIDC Sessions

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This vulnerability is fixed in 2.1.0.

Record
CVE-2026-40939
CVSS 4.0
6.8 MediumCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-613
Updated
2026-11-02
EUVDEUVD-2026-24493 6.8

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This vulnerability is fixed in 2.1.0.

Record
EUVD-2026-24493
CVSS 4.0
6.8 MediumCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-gj7p-595x-qwf5 6.8

Data Sharing Framework is Missing Session Timeout for OIDC Sessions

Affected Components

DSF FHIR Server with enabled OIDC authentication. DSF BPE Server with enabled OIDC authentication.

Summary

OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired.

Impact

If a user logs in via OIDC and leaves their browser without explicitly logging out, the session remains valid indefinitely. Another person using the same browser can access the DSF UI with the previous user's permissions. This is a realistic threat in hospital environments with shared workstations.

Only affects OIDC browser sessions, not relevant for mTLS machine-to-machine communication.

Fix (commits f4ecb00, 7d25fea)

  • Added configurable session timeout via dev.dsf.server.auth.oidc.session.timeout (default: PT30M).
  • Enabled logoutWhenIdTokenIsExpired(true) in OpenID configuration to tie session lifetime to token lifetime.
  • Websocket sessions are now closed with VIOLATED_POLICY when credentials expire, prevents stale websocket connections from continuing to receive events after session timeout.
Record
GHSA-gj7p-595x-qwf5
CVSS 4.0
6.8 MediumCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-613
Updated
2026-11-02
NVD 6.8

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This vulnerability is fixed in 2.1.0.

Record
CVE-2026-40939
CVSS 4.0
6.8 MediumCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-613
Updated
2026-11-02
OSV 6.8

DSF: Missing Session Timeout for OIDC Sessions

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This vulnerability is fixed in 2.1.0.

Record
CVE-2026-40939
CVSS 4.0
6.8 MediumCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-613
Updated
2026-11-02
OSVGHSA-gj7p-595x-qwf5 6.8

Data Sharing Framework is Missing Session Timeout for OIDC Sessions

Affected Components

DSF FHIR Server with enabled OIDC authentication. DSF BPE Server with enabled OIDC authentication.

Summary

OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired.

Impact

If a user logs in via OIDC and leaves their browser without explicitly logging out, the session remains valid indefinitely. Another person using the same browser can access the DSF UI with the previous user's permissions. This is a realistic threat in hospital environments with shared workstations.

Only affects OIDC browser sessions, not relevant for mTLS machine-to-machine communication.

Fix (commits f4ecb00, 7d25fea)

  • Added configurable session timeout via dev.dsf.server.auth.oidc.session.timeout (default: PT30M).
  • Enabled logoutWhenIdTokenIsExpired(true) in OpenID configuration to tie session lifetime to token lifetime.
  • Websocket sessions are now closed with VIOLATED_POLICY when credentials expire, prevents stale websocket connections from continuing to receive events after session timeout.
Record
GHSA-gj7p-595x-qwf5
CVSS 4.0
6.8 MediumCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-613
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dev.dsf:dsf-common-jetty
Maven
 before 2.1.0
2.1.0
dev.dsf:dsf-fhir-server
Maven
 before 2.1.0
2.1.0
dev.dsf:dsf-bpe-server
Maven
 before 2.1.0
2.1.0
dev.dsf:dsf-common-jetty
Maven
 All versions, plus listed versions
1.0.01.0.0-M11.1.01.2.01.2.0-RC1
Show 12 moreShow less
1.3.01.3.11.3.21.4.01.5.01.5.11.5.21.6.01.7.01.7.11.8.01.9.0
 None known
dev.dsf:dsf-fhir-server
Maven
 All versions, plus listed versions
1.0.01.0.0-M11.1.01.2.01.2.0-RC1
Show 12 moreShow less
1.3.01.3.11.3.21.4.01.5.01.5.11.5.21.6.01.7.01.7.11.8.01.9.0
 None known
dev.dsf:dsf-bpe-server
Maven
 All versions, plus listed versions
1.0.01.0.0-M11.1.01.2.01.2.0-RC1
Show 12 moreShow less
1.3.01.3.11.3.21.4.01.5.01.5.11.5.21.6.01.7.01.7.11.8.01.9.0
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40939 is a medium vulnerability (CVSS 6.8) in Datasharingframework Dsf, published April 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in dev.dsf:dsf-common-jetty 2.1.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open