PT-2026-49727 · Perryts · Perry

Katriel Moses + 1 · Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-53776

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Perry versions prior to 0.5.1166

Description An issue in the JWT validation process allows remote attackers to bypass token expiration. This occurs because the verify decode helper within the stdlib JWT verification path unconditionally sets validate exp to false. Consequently, attackers with a previously issued bearer token can use expired tokens in any jwt.verify() call to maintain authenticated access indefinitely, bypassing session expiration mechanisms such as administrative revocation or user logout.

Recommendations Update to version 0.5.1166 or later.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-53776

Affected Products

Perry

References · 5

• https://github.com/PerryTS/perry/security/advisories/GHSA-5324-c68v-8w62 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53776 · Security Note
• https://vulncheck.com/advisories/perry-jwt-expiration-bypass-via-verify-decode · Note
• https://twitter.com/OrizonCyber/status/2066936366328426748 · Twitter Post
• https://github.com/PerryTS/perry/releases/v0.5.1166 · Note