Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the DSF FHIR and BPE Servers with enabled OIDC authentication due to the lack of session timeout enforcement in OIDC browser sessions. An attacker can gain unauthorized access to a user's session by...

PT-2026-35189

Affected Components - DSF FHIR Server with enabled bearer-token authentication or back-channel logout. - DSF BPE Server with enabled bearer-token authentication or back-channel logout. - DSF BPE Server API v2 process plugins using FHIR client connections with configured OIDC authentication. Summa...

dev.dsf:dsf-bpe-server-jetty (>=1.0.0-m1, <=1.1.0), dev.dsf:dsf-common-jetty (>=1.0.0-m1, <=1.1.0) +1 more potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (11.0.15)

org.eclipse.jetty:jetty-openid MAVEN version 11.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-openid and may be impacted: - dev.dsf:dsf-bpe-server-jetty =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.1.0 Source cves: CVE-2023-41900...