Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the DSF FHIR and BPE Servers with enabled OIDC authentication due to the lack of session timeout enforcement in OIDC browser sessions. An attacker can gain unauthorized access to a user's session by...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the DSF FHIR and BPE Servers with enabled OIDC authentication due to the lack of session timeout enforcement in OIDC browser sessions. An attacker can gain unauthorized access to a user's session by...

Data Sharing Framework is Missing Session Timeout for OIDC Sessions

Affected Components DSF FHIR Server with enabled OIDC authentication. DSF BPE Server with enabled OIDC authentication. Summary OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. Impact If...

PT-2026-35189

Affected Components - DSF FHIR Server with enabled bearer-token authentication or back-channel logout. - DSF BPE Server with enabled bearer-token authentication or back-channel logout. - DSF BPE Server API v2 process plugins using FHIR client connections with configured OIDC authentication. Summa...

dev.dsf:dsf-bpe-server-jetty (>=1.0.0-m1, <=1.1.0), dev.dsf:dsf-common-jetty (>=1.0.0-m1, <=1.1.0) +1 more potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (11.0.15)

org.eclipse.jetty:jetty-openid MAVEN version 11.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-openid and may be impacted: - dev.dsf:dsf-bpe-server-jetty =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.1.0 Source cves: CVE-2023-41900...

dev.dsf:dsf-bpe-server-jetty (>=1.0.0-m1, <=1.1.0), dev.dsf:dsf-common-jetty (>=1.0.0-m1, <=1.1.0) +1 more potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (11.0.15)

org.eclipse.jetty:jetty-openid MAVEN version 11.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-openid and may be impacted: - dev.dsf:dsf-bpe-server-jetty =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.1.0 Source cves: CVE-2023-41900...