PT-2026-49727 · Perry · Perry

Katriel Moses + 1 · CVE-2026-53776 · Published 2026-06-16 · Updated 2026-06-17

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Perry versions prior to 0.5.1166

Description An issue in the JWT validation process allows remote attackers to bypass token expiration. This occurs because the verify decode helper within the stdlib JWT verification path unconditionally sets validate exp to false. Consequently, attackers with a previously issued bearer token can use expired tokens in any jwt.verify() call to maintain authenticated access indefinitely, bypassing session expiration mechanisms such as administrative revocation or user logout.

Recommendations Update to version 0.5.1166 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-53776

GHSA-5324-C68V-8W62

Affected Products

Perry

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53776.json · Exploit
• https://github.com/PerryTS/perry/security/advisories/GHSA-5324-c68v-8w62 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53776 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53776 · Security Note
• https://github.com/PerryTS/perry · Note
• https://github.com/PerryTS/perry/releases/v0.5.1166 · Note
• https://twitter.com/CVEnew/status/2066980897883365450 · Twitter Post
• https://twitter.com/ThreatAft/status/2067089132069990872 · Twitter Post
• https://t.me/CVEtracker/57022 · Telegram Post
• https://vulncheck.com/advisories/perry-jwt-expiration-bypass-via-verify-decode · Note
• https://twitter.com/OrizonCyber/status/2066936366328426748 · Twitter Post