CVE-2026-53776
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability in the Perry library before version 0.5.1166 allows remote attackers to bypass JWT token expiration validation. This is caused by the unconditional setting of validate_exp = false in the verify_decode helper within the standard JWT verification path.
Risk Assessment
An attacker with a previously issued token can use it indefinitely, even after user logout or administrative session revocation. This leads to unauthorized system access and session integrity compromise.
Recommendation
Immediately update the Perry library to version 0.5.1166 or later. If an update is not possible, manually enforce token expiration validation in the application code.
Original NVD description (English source)
Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = false in the verify_decode helper within the stdlib JWT verification path. Attackers in possession of a previously issued bearer token can present expired tokens to any jwt.verify() call and retain authenticated access indefinitely, bypassing force-expired sessions such as user logout or administrative revocation.