CVE-2026-77130: Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

Published Aug 25, 2026

Updated

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.

Affected Software

1 affected component

TYPO3 extension/SYSSY - TYPO3 Monitoring & Security Checks (syssy)

Event History

Aug 25, 2026

CVE Published

via MITRE·09:00 AM

Data Sourced

via MITRE·09:00 AM

DescriptionWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires control of a valid SYSSY project API key. An unauthenticated attacker without that API key is not described as able to exploit the issue.

What access does exploitation provide?

An attacker with the required API key can authenticate using an expired client-supplied JWT token. The provided CVSS vector indicates limited impact to confidentiality and integrity, with no availability impact.

How can I determine whether this is being exploited?

Review authentication activity for use of JWTs whose expiration time had already passed but that were nevertheless accepted. Also investigate whether any SYSSY project API key may have been exposed or taken over.

CVE-2026-77130: Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does exploitation provide?

How can I determine whether this is being exploited?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does exploitation provide?

How can I determine whether this is being exploited?