Perry JWT Validation Bypass via Expired Tokens

Executive Summary

CVE-2026-53776 is a critical vulnerability in Perry versions before 0.5.1166 that affects the JWT (JSON Web Token) validation process. Specifically, the vulnerability arises because the verify_decode helper function in the stdlib JWT verification path unconditionally disables token expiration validation by setting validate_exp to false.

This flaw allows remote attackers who possess a previously issued bearer token to bypass the expiration check of JWT tokens. As a result, expired tokens can still be accepted as valid by any jwt.verify() call, enabling attackers to maintain authenticated access indefinitely.

This means that even after a user logs out or an administrator revokes a session, the attacker can continue to use the expired token to access the system without restriction.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts on the security of applications using Perry for JWT authentication.

• Attackers can bypass token expiration and maintain indefinite authenticated access using expired tokens.
• It allows unauthorized users to bypass session termination mechanisms such as user logout or administrative revocation.
• The flaw compromises confidentiality and integrity by allowing persistent unauthorized access without requiring privileges or user interaction.
• Because the vulnerability is remotely exploitable over a network with low attack complexity, it poses a high risk to affected systems.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Perry to version 0.5.1166 or later, where the issue with unconditional disabling of JWT token expiration validation has been fixed.

Additionally, consider rotating signing keys to invalidate any previously issued tokens that might have been exploited.

Review your use of jwt.verify() calls to ensure that token expiration validation is properly enforced.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to bypass JWT token expiration, enabling indefinite authenticated access even after sessions should have been terminated, such as during user logout or administrative revocation.

This persistent unauthorized access can lead to insufficient session expiration controls, which is a critical security failure impacting confidentiality and integrity of user data.

Such a failure can negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require proper session management and protection of sensitive data to prevent unauthorized access.

Useful 0 Not Useful 0