The Data Sharing Framework gave OIDC‑authenticated users no inactivity timeout before version 2.1.0. Consequently, a user who logged in could maintain an active session even once the underlying OIDC access token had expired. The vulnerability presents a classic absence‑of‑session‑termination weakness (CWE‑613) that enables an attacker or an abuse of an existing session to continue accessing protected resources without further authentication.

Affected consumers include deployments of datasharingframework:dsf, dev.dsf:dsf‑bpe‑server, dev.dsf:dsf‑common‑jetty, and dev.dsf:dsf‑fhir‑server. All releases prior to 2.1.0 are impacted. Version 2.1.0 and later contain the session‑timeout fix.

The CVSS score of 6.8 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation data. Based on the description, it is inferred that attackers could exploit this via the web interface or API after initially authenticating, keeping the session alive indefinitely and bypassing time‑based access controls. The risk is primarily to confidentiality and integrity of the resources accessed during the lingering session.