JWT Validation Vulnerability in Perry by PerryTS

CVE-2026-53776

What is CVE-2026-53776?

Perry before version 0.5.1166 is susceptible to a JWT validation vulnerability, allowing remote attackers to exploit an improperly configured validation setting. This flaw permits attackers to bypass token expiration, as the 'validate_exp' parameter in the verify_decode helper is mistakenly set to false. As a result, attackers holding a previously issued bearer token can use expired tokens for authentication during jwt.verify() calls. This compromise enables continuous access to the application, undermining session management features like user logout and administrative session revocation.

References