CVE-2026-53776: Perry JWT Auth Bypass Vulnerability

CVE-2026-53776 Overview

CVE-2026-53776 is a JSON Web Token (JWT) validation vulnerability in Perry before version 0.5.1166. The flaw resides in the verify_decode helper within the stdlib JWT verification path, which unconditionally sets validate_exp = false. As a result, any call to jwt.verify() accepts expired tokens as valid. Remote attackers holding a previously issued bearer token can replay it indefinitely, bypassing forced session termination such as user logout or administrative revocation. The issue is tracked under CWE-613: Insufficient Session Expiration.

Critical Impact
Attackers with any previously issued bearer token retain authenticated access indefinitely, defeating logout and revocation controls across all Perry-protected endpoints.

Affected Products

Perry versions prior to 0.5.1166
Applications using Perry's stdlib JWT verify_decode helper
Services relying on Perry's jwt.verify() for session expiration enforcement

Discovery Timeline

2026-06-16 - CVE-2026-53776 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53776

Vulnerability Analysis

The vulnerability stems from a hard-coded configuration in Perry's JWT verification logic. The verify_decode helper passes validate_exp = false to the underlying JWT validation routine on every invocation. This disables the standard exp (expiration) claim check defined in RFC 7519.

Any token validated through jwt.verify() is treated as current regardless of its exp value. Signature verification still succeeds for tokens signed with the correct key, so attackers cannot forge tokens. However, any token that was ever legitimately issued remains usable forever. This breaks the standard session lifecycle assumption that revoked or logged-out tokens become unusable after expiration.

The vulnerability is exploitable remotely over the network without authentication beyond the captured token, and requires no user interaction. See the VulnCheck Advisory on JWT Bypass for additional technical detail.

Root Cause

The root cause is an unconditional disabling of expiration validation in the JWT verification helper. By statically setting validate_exp = false, Perry removes the temporal binding that ensures tokens are only valid within their issued window. This is a classic [CWE-613] insufficient session expiration defect at the library layer.

Attack Vector

An attacker who obtains a bearer token through any means, including session capture, log exposure, browser artifact theft, or a prior compromise, can present that token to any Perry-protected endpoint after expiration. The server accepts the token, restores the associated session, and grants access. Administrative actions such as forcing logout or revoking sessions through expiration do not invalidate the captured token.

The vulnerability is exploited by submitting an expired JWT in the Authorization: Bearer header against any endpoint that calls jwt.verify(). No payload modification or signature manipulation is required. The original signed token, replayed after its expiration timestamp, is sufficient. Refer to the GitHub Security Advisory GHSA-5324 for vendor analysis.

Detection Methods for CVE-2026-53776

Indicators of Compromise

Successful authenticated requests carrying JWTs whose exp claim is in the past
Session activity from user accounts after a confirmed logout or administrative revocation event
Repeated use of the same jti or token signature across long time windows beyond the configured token lifetime
Authentication events from IP addresses or user agents that differ from the original token issuance context

Detection Strategies

Decode incoming JWTs at an edge proxy or WAF and log the exp claim alongside the request timestamp to flag expired tokens accepted by the application
Correlate logout and revocation events against subsequent authenticated activity for the same subject to identify post-revocation token reuse
Audit application logs for verify_decode invocations and confirm whether the underlying library version is 0.5.1166 or later

Monitoring Recommendations

Centralize authentication logs and alert on any request where the decoded JWT exp is earlier than the server receive time
Track token-to-session lifetime ratios and alert when tokens remain in use beyond their intended validity window
Monitor the Authorization header for token reuse patterns spanning logout boundaries

How to Mitigate CVE-2026-53776

Immediate Actions Required

Upgrade Perry to version 0.5.1166 or later as published in the GitHub Release v0.5.1166
Rotate the JWT signing key to invalidate every previously issued token, including any that attackers may already hold
Force re-authentication for all active sessions after rotating the signing key
Audit recent authentication logs for evidence of expired-token acceptance prior to patching

Patch Information

The fix is delivered in Perry 0.5.1166. The patched release restores expiration validation in the verify_decode helper so that jwt.verify() rejects tokens whose exp claim has elapsed. Release notes and source changes are available in the GitHub Release v0.5.1166 and the GitHub Security Advisory GHSA-5324.

Workarounds

Wrap jwt.verify() calls with an application-level check that decodes the token and rejects requests where exp is in the past
Enforce a server-side session revocation list keyed by jti so that logout and administrative revocation invalidate tokens independent of the exp claim
Reduce token lifetime to a short window and pair JWTs with short-lived refresh tokens validated against server state until the patch is applied

bash

# Configuration example: pin Perry to the fixed version
# package manifest
perry = ">=0.5.1166"

# verify upgrade
perry --version   # expect 0.5.1166 or later