CVE-2026-40939

UNKNOWN 0.0

DSF: Missing Session Timeout for OIDC Sessions

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This vulnerability is fixed in 2.1.0.

CWE	CWE-613
Vendor	datasharingframework
Product	dsf
Published	Apr 21, 2026

Stay Ahead of the Next One

Get instant alerts for datasharingframework dsf

Be the first to know when new unknown vulnerabilities affecting datasharingframework dsf are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

datasharingframework / dsf

< 2.1.0

dev.dsf / dsf-bpe-server

< 2.1.0

dev.dsf / dsf-common-jetty

< 2.1.0

dev.dsf / dsf-fhir-server

< 2.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/datasharingframework/dsf/security/advisories/GHSA-gj7p-595x-qwf5 github.com: https://github.com/datasharingframework/dsf/commit/f4ecb002f7d12642f92da6b79371ed367d0140e7 dsf.dev: https://dsf.dev/operations/v2.1.0/bpe/oidc.html dsf.dev: https://dsf.dev/operations/v2.1.0/fhir/oidc.html