---
id: CVE-2026-53776
title: Perry < 0.5.1166 JWT Expiration Bypass via verify_decode
summary: >-
  Perry before 0.5.1166 contains a JWT validation vulnerability that allows
  remote attackers to bypass token expiration by exploiting the unconditional
  setting of validate_exp = false in the verify_decode helper within the stdlib
  JWT verif…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-613
vendor: PerryTS
product: perry
affected:
  - perry < 0.5.1166
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-06-16T17:04:20.295770Z'
published: '2026-06-16'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:03.490Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53776'
references:
  - url: 'https://github.com/PerryTS/perry/releases/v0.5.1166'
  - url: 'https://github.com/PerryTS/perry/security/advisories/GHSA-5324-c68v-8w62'
    label: GitHub Security Advisory (GHSA-5324-c68v-8w62)
  - url: >-
      https://www.vulncheck.com/advisories/perry-jwt-expiration-bypass-via-verify-decode
tags:
  - cve.org
epss: 0.00357
epssPercentile: 0.2971
ingestedAt: '2026-11-08T14:51:22.379Z'
---

## Overview

Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = false in the verify_decode helper within the stdlib JWT verification path. Attackers in possession of a previously issued bearer token can present expired tokens to any jwt.verify() call and retain authenticated access indefinitely, bypassing force-expired sessions such as user logout or administrative revocation.

## Affected

- `perry < 0.5.1166`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.