CVE-2026-53776 — Perry < 0.5.1166 JWT Expiration Bypass via verify_decode
Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = f…
Published: 2026-06-16 · CVSS: 9.3 · CVSS 4.0
Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = false in the verify_decode helper within the stdlib JWT verification path. Attackers in possession of a previously issued bearer token can present expired tokens to any jwt.verify() call and retain authenticated access indefinitely, bypassing force-expired sessions such as user logout or administrative revocation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7