The Data Sharing Framework implements caching for OIDC JWKS, metadata, and token values. In versions before 2.1.0 the logic used an inverted time comparison, causing cached entries to never be regarded as valid and, for the token cache, never to be invalidated. As a result, each request triggers a fetch of the OIDC metadata and JWKS keys, and every request is served with the same expired token. An attacker can exploit this flaw by simply continuing to send requests, thereby maintaining unauthorized access with tokens that should have been rejected. The core weakness is a misuse of time comparison, identified as CWE‑670.

This flaw affects the Data Sharing Framework by datasharingframework, specifically the dsf‑bpe‑process‑api‑v2 and dsf‑bpe‑server components. All releases older than 2.1.0 are vulnerable; 2.1.0 and later include the fix.

The CVSS score of 6.3 classifies the issue as moderate. The vulnerability is exploitable over remote HTTP traffic to DSF services. No EPSS data is available and the issue is not listed in the CISA KEV catalog, so known exploitation is not documented. Nevertheless, any party able to issue repeated requests can leverage the expired‑token reuse to gain authorized data access or potentially elevate privileges.