Medium severity · published Aug 25, 2026
CVE-2026-77130
Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Extension "SYSSY - TYPO3 Monitoring & Security Checks" · TYPO3
before 3.0.6 · source: vendor
Affected product
ES
Extension "SYSSY - TYPO3 Monitoring & Security Checks"
TYPO3
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77130
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77130
typo3.org
https://typo3.org/security/advisory/typo3-ext-sa-2026-015
More from Extension "SYSSY - TYPO3 Monitoring & Security Checks"
5.3
CVE-2026-77131
Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)