CVE-2026-53776: Insufficient Session Expiration in PerryTS perry
Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = false in the verify_decode helper within the stdlib JWT verification path. Attackers in possession of a previously issued bearer token can present expired tokens to any jwt.verify() call and retain authenticated access indefinitely, bypassing force-expired sessions such as user logout or administrative revocation.
AI Analysis
Technical Summary
CVE-2026-53776 affects Perry before version 0.5.1166 and involves a JWT validation flaw where the expiration check is disabled (validate_exp = false) in the verify_decode helper function within the standard JWT verification path. This allows an attacker with a previously issued token to bypass expiration controls and continue authenticated sessions indefinitely, circumventing forced session termination mechanisms such as user logout or token revocation.
Potential Impact
The vulnerability enables attackers to use expired JWT bearer tokens to maintain unauthorized authenticated access indefinitely. This undermines session expiration controls and can allow persistent access without reauthentication, posing a critical risk to affected systems.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing additional controls such as server-side session invalidation or token revocation mechanisms outside of JWT expiration checks to mitigate risk.
CVE-2026-53776: Insufficient Session Expiration in PerryTS perry
Description
Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = false in the verify_decode helper within the stdlib JWT verification path. Attackers in possession of a previously issued bearer token can present expired tokens to any jwt.verify() call and retain authenticated access indefinitely, bypassing force-expired sessions such as user logout or administrative revocation.
CVSS v4.0
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-53776 affects Perry before version 0.5.1166 and involves a JWT validation flaw where the expiration check is disabled (validate_exp = false) in the verify_decode helper function within the standard JWT verification path. This allows an attacker with a previously issued token to bypass expiration controls and continue authenticated sessions indefinitely, circumventing forced session termination mechanisms such as user logout or token revocation.
Potential Impact
The vulnerability enables attackers to use expired JWT bearer tokens to maintain unauthorized authenticated access indefinitely. This undermines session expiration controls and can allow persistent access without reauthentication, posing a critical risk to affected systems.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing additional controls such as server-side session invalidation or token revocation mechanisms outside of JWT expiration checks to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-10T20:14:32.825Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3196650b89be688808a4ac
Added to database: 06/16/2026, 18:31:01 UTC
Last enriched: 07/15/2026, 10:10:59 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.