CVE-2026-53776
Critical
Description
Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = false in the verify_decode helper within the stdlib JWT verification path. Attackers in possession of a previously issued bearer token can present expired tokens to any jwt.verify() call and retain authenticated access indefinitely, bypassing force-expired sessions such as user logout or administrative revocation.
SeverityCritical
CVSS9.1
Exploit probability—
ProductPerry
PublishedJun 16, 2026
First seenJun 16, 2026
Weakness typeCWE-613CWE-613
How to fix
Update
- PerryTS perry0.5.1166 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PerryTS perry | v < 0.5.1166 | 0.5.1166 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.