Listen to this Post
The root cause of this vulnerability is a logic inversion in the OIDC client’s caching mechanism. Specifically, when checking if a cached OIDC metadata document, JWKS, or access token is still valid, the code uses `isBefore` instead of the correct `isAfter` method to compare the current time against the cached item’s expiry timestamp. For the metadata and JWKS caches, the condition `currentTime.isBefore(expiryTime)` is used to determine if the cached item is still fresh. Because the current time is always after the expiry time for any expired item, the condition evaluates to false, causing the cache to be considered stale immediately. Consequently, every incoming request bypasses the cache and triggers a new HTTP fetch from the OIDC provider. For the OIDC token cache, the inverted logic means that the expiration check never triggers invalidation. The code uses `isBefore` to see if the token has expired, but since the expiry time is always before the current time for an expired token, the condition fails, and the expired token is returned indefinitely. The only way to clear a stale token is to restart the BPE server. This flawed logic affects `BaseOidcClientWithCache` (for configuration and JWKS) and `OidcClientWithCache` (for configuration, JWKS, and access tokens). The fix, introduced in commits `31c2e974d` and d3ca59b4d, corrects the comparison to `isAfter` and adds configurable cache timeouts via properties `dev.dsf.server.auth.oidc.provider.client.cache.timeout.configuration.resource` and `dev.dsf.server.auth.oidc.provider.client.cache.timeout.jwks.resource` (default PT1H). The issue affects DSF BPE Server versions prior to 2.1.0.
dailycve form:
Platform: DSF BPE Server
Version: < 2.1.0
Vulnerability : Inverted Time Comparison
Severity: Moderate
date: 2026-04-15
Prediction: Patch in v2.1.0 (commits 31c2e974d, d3ca59b4d)
Analytics under What Undercode Say:
!/bin/bash Simulate the cache behavior: always fetch fresh data while true; do This curl would always hit the OIDC provider curl -X GET "https://oidc-provider/.well-known/openid-configuration" sleep 1 done
// Vulnerable code in BaseOidcClientWithCache
if (currentTime.isBefore(cachedEntry.getExpiryTime())) {
return cachedEntry; // Never reached because isBefore is false
} else {
fetchFreshData(); // Executes on every request
}
New configuration properties to set cache timeouts dev.dsf.server.auth.oidc.provider.client.cache.timeout.configuration.resource: PT1H dev.dsf.server.auth.oidc.provider.client.cache.timeout.jwks.resource: PT1H
How Exploit:
An attacker can force the server to continuously fetch OIDC metadata and tokens, causing a denial-of-service (DoS) on the OIDC provider. By sending repeated authenticated requests, the attacker exhausts the provider’s rate limits and degrades performance for all clients. Additionally, if the OIDC provider becomes temporarily unreachable, the server immediately fails all requests instead of using cached data, enabling a trivial DoS. The expired token cache also allows the attacker to use a valid token long after it has expired, bypassing revocation checks.
Protection from this CVE:
Upgrade to DSF BPE Server version 2.1.0 or later, which contains the fix in commits `31c2e974d` and d3ca59b4d. If upgrading is not immediately possible, manually apply the patch by replacing `isBefore` with `isAfter` in the `BaseOidcClientWithCache` and `OidcClientWithCache` classes, then rebuild the JAR. Configure cache timeouts explicitly using the new properties to limit the impact of any future logic errors. Monitor OIDC provider logs for unusual fetch rates and restart the BPE server periodically to clear potentially stale tokens until the upgrade is complete.
Impact:
- Performance: Every OIDC-authenticated request adds network round-trips to the OIDC provider, increasing latency.
- Reliability: Cached OIDC tokens become unusable after expiration and can only be invalidated by restarting the BPE. If the OIDC provider is temporarily unreachable, all requests fail immediately instead of using cached keys.
- Load: Unnecessary load on the OIDC provider, potentially causing rate limiting or service degradation for all clients.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
