Skip to content

Commit be0452b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7x63-xv5r-3p2x GHSA-gj7p-595x-qwf5 GHSA-xmj9-7625-f634
1 parent 97a548b commit be0452b

File tree

3 files changed

+248
-0
lines changed

3 files changed

+248
-0
lines changed

‎advisories/github-reviewed/2026/04/GHSA-7x63-xv5r-3p2x/GHSA-7x63-xv5r-3p2x.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7x63-xv5r-3p2x",
4+
"modified": "2026-04-15T19:21:06Z",
5+
"published": "2026-04-15T19:21:06Z",
6+
"aliases": [
7+
"CVE-2026-40575"
8+
],
9+
"summary": "OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing",
10+
"details": "### Impact\n\nA configuration-dependent authentication bypass exists in OAuth2 Proxy.\n\nDeployments are affected when all of the following are true:\n\n* OAuth2 Proxy is configured with `--reverse-proxy`\n* and at least one rule is defined with `--skip_auth_routes` or the legacy `--skip-auth-regex`\n\nOAuth2 Proxy may trust a client-supplied `X-Forwarded-Uri` header when `--reverse-proxy` is enabled and `--skip-auth-route` or `--skip-auth-regex` is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application.\n\nThis can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session.\n\n\n### Patches\nThis issue is addressed as part of the newly introduced `--trusted-proxy-ip` flag in `v7.15.2`. If you leave it unset, OAuth2 Proxy will **continue to trust ALL** source IPs (0.0.0.0/0) for backwards compatibility, which means a client may still be able to spoof forwarded headers. Therefore after upgrading we urge you to use the new `--trusted-proxy-ip` flag to set the IPs or CIDR ranges of the reverse proxies that are allowed to send `X-Forwarded-*` headers and furthermore implement the mitigation steps outlined below to properly configure your load balancer infrastructure.\n\n### Mitigation\n\n- Strip any client-provided `X-Forwarded-Uri` header at the reverse proxy or load balancer level\n- Explicitly overwrite `X-Forwarded-Uri` with the actual request URI before forwarding requests to OAuth2 Proxy\n\n Example nginx mitigation for the auth subrequest:\n ```\n location /internal-auth/ {\n internal; # Ensure external users can't access this path\n \n # Make sure the OAuth2 Proxy knows where the original request came from.\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n # set the value to the actual $request_uri and therefore strip any user provided X-Forwarded-Uri\n proxy_set_header X-Forwarded-Uri $request_uri;\n \n proxy_pass http://oauth2-proxy:4180/;\n }\n ```\n- Restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy\n- Remove or narrow `--skip-auth-route` / `--skip-auth-regex` rules where possible",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/oauth2-proxy/oauth2-proxy/v7"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "7.5.0"
29+
},
30+
{
31+
"fixed": "7.15.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/oauth2-proxy/oauth2-proxy"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-290"
51+
],
52+
"severity": "CRITICAL",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-04-15T19:21:06Z",
55+
"nvd_published_at": null
56+
}
57+
}

‎advisories/github-reviewed/2026/04/GHSA-gj7p-595x-qwf5/GHSA-gj7p-595x-qwf5.json‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gj7p-595x-qwf5",
4+
"modified": "2026-04-15T19:19:43Z",
5+
"published": "2026-04-15T19:19:43Z",
6+
"aliases": [],
7+
"summary": "Data Sharing Framework is Missing Session Timeout for OIDC Sessions",
8+
"details": "### Affected Components\nDSF FHIR Server with enabled [OIDC authentication](https://dsf.dev/operations/v2.1.0/fhir/oidc.html).\nDSF BPE Server with enabled [OIDC authentication](https://dsf.dev/operations/v2.1.0/bpe/oidc.html).\n\n### Summary\nOIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired.\n\n### Impact\nIf a user logs in via OIDC and leaves their browser without explicitly logging out, the session remains valid indefinitely. Another person using the same browser can access the DSF UI with the previous user's permissions. This is a realistic threat in hospital environments with shared workstations.\n\nOnly affects OIDC browser sessions, not relevant for mTLS machine-to-machine communication.\n\n### Fix (commits f4ecb00, 7d25fea)\n- Added configurable session timeout via `dev.dsf.server.auth.oidc.session.timeout` (default: `PT30M`).\n- Enabled `logoutWhenIdTokenIsExpired(true)` in OpenID configuration to tie session lifetime to token lifetime.\n- Websocket sessions are now closed with `VIOLATED_POLICY` when credentials expire, prevents stale websocket connections from continuing to receive events after session timeout.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Maven",
19+
"name": "dev.dsf:dsf-common-jetty"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
}
28+
]
29+
}
30+
],
31+
"database_specific": {
32+
"last_known_affected_version_range": "< 2.1.0"
33+
}
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "Maven",
38+
"name": "dev.dsf:dsf-fhir-server"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "0"
46+
}
47+
]
48+
}
49+
],
50+
"database_specific": {
51+
"last_known_affected_version_range": "< 2.1.0"
52+
}
53+
},
54+
{
55+
"package": {
56+
"ecosystem": "Maven",
57+
"name": "dev.dsf:dsf-bpe-server"
58+
},
59+
"ranges": [
60+
{
61+
"type": "ECOSYSTEM",
62+
"events": [
63+
{
64+
"introduced": "0"
65+
}
66+
]
67+
}
68+
],
69+
"database_specific": {
70+
"last_known_affected_version_range": "< 2.1.0"
71+
}
72+
}
73+
],
74+
"references": [
75+
{
76+
"type": "WEB",
77+
"url": "https://github.com/datasharingframework/dsf/security/advisories/GHSA-gj7p-595x-qwf5"
78+
},
79+
{
80+
"type": "WEB",
81+
"url": "https://github.com/datasharingframework/dsf/commit/7d25feafb83d66cb59985ac88568b67d937b1937"
82+
},
83+
{
84+
"type": "WEB",
85+
"url": "https://github.com/datasharingframework/dsf/commit/f4ecb002f7d12642f92da6b79371ed367d0140e7"
86+
},
87+
{
88+
"type": "WEB",
89+
"url": "https://dsf.dev/operations/v2.1.0/bpe/oidc.html"
90+
},
91+
{
92+
"type": "WEB",
93+
"url": "https://dsf.dev/operations/v2.1.0/fhir/oidc.html"
94+
},
95+
{
96+
"type": "PACKAGE",
97+
"url": "https://github.com/datasharingframework/dsf"
98+
}
99+
],
100+
"database_specific": {
101+
"cwe_ids": [
102+
"CWE-613"
103+
],
104+
"severity": "MODERATE",
105+
"github_reviewed": true,
106+
"github_reviewed_at": "2026-04-15T19:19:43Z",
107+
"nvd_published_at": null
108+
}
109+
}

‎advisories/github-reviewed/2026/04/GHSA-xmj9-7625-f634/GHSA-xmj9-7625-f634.json‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xmj9-7625-f634",
4+
"modified": "2026-04-15T19:19:50Z",
5+
"published": "2026-04-15T19:19:50Z",
6+
"aliases": [],
7+
"summary": "Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache",
8+
"details": "### Affected Components\n- DSF FHIR Server with enabled [bearer-token authentication](https://dsf.dev/operations/v2.1.0/fhir/oidc.html) or [back-channel logout](https://dsf.dev/operations/v2.1.0/fhir/oidc.html).\n- DSF BPE Server with enabled [bearer-token authentication](https://dsf.dev/operations/v2.1.0/bpe/oidc.html) or [back-channel logout](https://dsf.dev/operations/v2.1.0/bpe/oidc.html).\n- DSF BPE Server API v2 process plugins using [FHIR client connections](https://dsf.dev/operations/v2.1.0/bpe/fhir-client-connections.html) with configured OIDC authentication.\n\n### Summary\n- The OIDC JWKS and Metadata Document caches used an inverted time comparison (`isBefore` instead of `isAfter`), causing the cache to **never return cached values**. Every incoming request triggered a fresh HTTP fetch of the OIDC Metadata Document and JWKS keys from the OIDC provider.\n- The OIDC token cache for the [FHIR client connections](https://dsf.dev/operations/v2.1.0/bpe/fhir-client-connections.html) used an inverted time comparison (`isBefore` instead of `isAfter`), causing the cache to **never invalidate**. Every incoming request returned the same OIDC token even if expired.\n\n### Impact\n- **Performance:** Every OIDC-authenticated request added network round-trips to the OIDC provider, increasing latency\n- **Reliability:** Cached OIDC tokens become unusable after expiration and can only be invalidated by restart of the BPE. \n If the OIDC provider is temporarily unreachable, all requests fail immediately instead of using cached keys\n- **Load:** Unnecessary load on the OIDC provider, potentially causing rate limiting\n\n### Fix (commits 31c2e974d, d3ca59b4d)\n- Fixed cache timeout comparison from `isBefore` to `isAfter` in `BaseOidcClientWithCache` (configuration and JWKS caches) and `OidcClientWithCache` (configuration, JWKS, and access token caches)\n- Added configurable cache timeouts via `dev.dsf.server.auth.oidc.provider.client.cache.timeout.configuration.resource` and `dev.dsf.server.auth.oidc.provider.client.cache.timeout.jwks.resource` (default: `PT1H`)",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Maven",
19+
"name": "dev.dsf:dsf-bpe-process-api-v2"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
}
28+
]
29+
}
30+
],
31+
"database_specific": {
32+
"last_known_affected_version_range": "< 2.1.0"
33+
}
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "Maven",
38+
"name": "dev.dsf:dsf-bpe-server"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "0"
46+
}
47+
]
48+
}
49+
],
50+
"database_specific": {
51+
"last_known_affected_version_range": "< 2.1.0"
52+
}
53+
}
54+
],
55+
"references": [
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/datasharingframework/dsf/security/advisories/GHSA-xmj9-7625-f634"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/datasharingframework/dsf/commit/31c2e974dfd4351756104ee8c53dbcd666192fef"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/datasharingframework/dsf/commit/d3ca59b4daccde16a006fedeccce28fd1f826908"
67+
},
68+
{
69+
"type": "PACKAGE",
70+
"url": "https://github.com/datasharingframework/dsf"
71+
}
72+
],
73+
"database_specific": {
74+
"cwe_ids": [
75+
"CWE-670"
76+
],
77+
"severity": "MODERATE",
78+
"github_reviewed": true,
79+
"github_reviewed_at": "2026-04-15T19:19:50Z",
80+
"nvd_published_at": null
81+
}
82+
}

0 commit comments

Comments
 (0)