CVE-2026-77130
CVE-2026-77130
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.
EPSS: 0.002 (10.7th percentile) — read the EPSS interpretation.
Weakness classification (CWE)
References
- f4fb688c-4412-4426-b4b8-421ecf27b14a (vendor-advisory)