The TYPO3 extension "SYSSY - TYPO3 Monitoring & Security Checks" contains an insufficient session expiration vulnerability (CWE-613). Specifically, it fails to properly validate the expiration time of JWT tokens supplied by clients. As a result, an attacker who has obtained a valid API key can reuse an expired JWT token to authenticate, bypassing expected session expiration controls. This vulnerability affects all versions of the extension before 3.0.6. There is no vendor advisory or patch currently available to address this issue.

An attacker with a valid API key can authenticate with expired JWT tokens, potentially extending their access beyond intended session lifetimes. This could allow unauthorized continued access to the extension's monitoring and security check functionalities. However, exploitation requires prior compromise of the API key, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to API keys and monitor for unauthorized use. No official fix or temporary workaround has been published by the vendor at this time.