GHSA-xmj9-7625-f634

Suggest an improvement
Source
https://github.com/advisories/GHSA-xmj9-7625-f634
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmj9-7625-f634/GHSA-xmj9-7625-f634.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xmj9-7625-f634
Aliases
Published
2026-04-15T19:19:50Z
Modified
2026-09-10T03:50:44Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache
Details

Affected Components

Summary

  • The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cached values. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider.
  • The OIDC token cache for the FHIR client connections used an inverted time comparison (isBefore instead of isAfter), causing the cache to never invalidate. Every incoming request returned the same OIDC token even if expired.

Impact

  • Performance: Every OIDC-authenticated request added network round-trips to the OIDC provider, increasing latency
  • Reliability: Cached OIDC tokens become unusable after expiration and can only be invalidated by restart of the BPE. If the OIDC provider is temporarily unreachable, all requests fail immediately instead of using cached keys
  • Load: Unnecessary load on the OIDC provider, potentially causing rate limiting

Fix (commits 31c2e974d, d3ca59b4d)

  • Fixed cache timeout comparison from isBefore to isAfter in BaseOidcClientWithCache (configuration and JWKS caches) and OidcClientWithCache (configuration, JWKS, and access token caches)
  • Added configurable cache timeouts via dev.dsf.server.auth.oidc.provider.client.cache.timeout.configuration.resource and dev.dsf.server.auth.oidc.provider.client.cache.timeout.jwks.resource (default: PT1H)
Database specific 
{
    "cwe_ids":  [
        "CWE-670"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-15T19:19:50Z",
    "nvd_published_at":  "2026-04-21T22:16:19Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / dev.dsf:dsf-bpe-process-api-v2

Package

Name
dev.dsf:dsf-bpe-process-api-v2
View open source insights on deps.dev
Purl
pkg:maven/dev.dsf/dsf-bpe-process-api-v2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.0-M2
2.0.0-M3
2.0.0-M4
2.0.0-RC1
2.0.0-RC2
2.0.0
2.0.1
2.0.2
2.1.0
2.1.1

Database specific

last_known_affected_version_range 
"< 2.1.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmj9-7625-f634/GHSA-xmj9-7625-f634.json"

Maven / dev.dsf:dsf-bpe-server

Package

Name
dev.dsf:dsf-bpe-server
View open source insights on deps.dev
Purl
pkg:maven/dev.dsf/dsf-bpe-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0-M1
1.0.0
1.1.0
1.2.0-RC1
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.5.0
1.5.1
1.5.2
1.6.0
1.7.0
1.7.1
1.8.0
1.9.0

Database specific

last_known_affected_version_range 
"< 2.1.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xmj9-7625-f634/GHSA-xmj9-7625-f634.json"