Executive Summary

CVE-2026-53776 is a critical vulnerability in Perry versions before 0.5.1166 that affects the JWT (JSON Web Token) validation process. Specifically, the vulnerability arises because the verify_decode helper function in the stdlib JWT verification path unconditionally disables token expiration validation by setting validate_exp to false.

This flaw allows remote attackers who possess a previously issued bearer token to bypass the expiration check of JWT tokens. As a result, expired tokens can still be accepted as valid by any jwt.verify() call, enabling attackers to maintain authenticated access indefinitely.

This means that even after a user logs out or an administrator revokes a session, the attacker can continue to use the expired token to access the system without restriction.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts on the security of applications using Perry for JWT authentication.

• Attackers can bypass token expiration and maintain indefinite authenticated access using expired tokens.
• It allows unauthorized users to bypass session termination mechanisms such as user logout or administrative revocation.
• The flaw compromises confidentiality and integrity by allowing persistent unauthorized access without requiring privileges or user interaction.
• Because the vulnerability is remotely exploitable over a network with low attack complexity, it poses a high risk to affected systems.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Perry to version 0.5.1166 or later, where the issue with unconditional disabling of JWT token expiration validation has been fixed.

Additionally, consider rotating signing keys to invalidate any previously issued tokens that might have been exploited.

Review your use of jwt.verify() calls to ensure that token expiration validation is properly enforced.

Useful 0 Not Useful 0