Executive brief
SYSSY is a TYPO3 extension that monitors and secures TYPO3 installations. It fails to properly validate JWT token expiration, allowing an attacker who possesses a valid API key to authenticate using expired tokens and potentially maintain unauthorized access. This requires the attacker to already have obtained the API key through other means.
Technical details
The extension implements JWT token validation but does not properly check token expiration timestamps, allowing expired tokens to be accepted for authentication. The vulnerability is classified as CWE-613 (Insufficient Session Expiration). Attack requires network access to the extension's API endpoint and a valid API key obtained by the attacker through prior compromise or disclosure. An authenticated attacker can use an expired token to authenticate and perform actions as if the token were still valid. A patch is available in version 3.0.6.
Affected products
- TYPO3 SYSSY 3.0.5 and below
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Version 3.0.6 released