CVE-2026-77130: CWE-613 Insufficient Session Expiration in TYPO3 Extension "SYSSY - TYPO3 Monitoring & Security Checks"

CVE-2026-77130 is an insufficient session expiration vulnerability (CWE-613) in the TYPO3 extension "SYSSY - TYPO3 Monitoring & Security Checks". The extension fails to correctly validate whether a client-supplied JWT token has expired, enabling an attacker who controls a valid API key to authenticate with an expired token. This issue affects all versions starting from 0 up to version 3.0.6, where presumably the issue is fixed. No known exploits are reported in the wild, and the vulnerability requires possession of a valid API key to exploit.

An attacker with a valid API key can bypass session expiration controls by using expired JWT tokens to authenticate. This could allow unauthorized access to the extension's functionality beyond the intended session lifetime. However, exploitation requires prior compromise of an API key, limiting the attack scope.

A fix is available in TYPO3 extension version 3.0.6 or later. Users should upgrade to version 3.0.6 or above to remediate this vulnerability. No additional mitigation guidance is provided or required beyond applying the official update.