CVE-2026-53776: Perry < 0.5.1166 JWT Expiration Bypass via verify_decode

Synopsis

An authentication bypass vulnerability in the Perry JWT library (versions before 0.5.1166) allows a remote attacker to reuse expired bearer tokens indefinitely. The bug stems from the verify_decode helper unconditionally setting validate_exp = false, meaning the library never checks whether a JSON Web Token has expired. Any attacker who holds a previously issued token, including one from a session that was force-expired via logout or administrative revocation, can present that token to any jwt.verify() call and gain continued authenticated access. A patched-image rebuild at version 0.5.1166 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network to present the expired token to a jwt.verify() endpoint.

• AuthenticationNot required

  No credential or account is needed beyond possession of a previously issued bearer token, which may have come from any prior session.

• Victim interactionNot required

  No user action is required; the attacker submits the expired token directly to the target service.

• Attack complexityDetail

  The exploit is straightforward and condition-free; no race conditions or special environmental configuration are required to bypass expiration validation.

Blast Radius

• The attacker reads resources and data accessible to the identity bound to the expired token, including session state, user records, and any API responses gated behind authentication.
• The attacker writes or modifies data on behalf of the hijacked identity, including submitting transactions, changing account settings, or altering application state.
• Revoked sessions (from logout, administrative action, or credential rotation) offer no protection; the attacker retains access for the full remaining validity window of any captured token, which is effectively unlimited.
• Any service in the same application that trusts a jwt.verify() result from the Perry library inherits the bypass, widening lateral reach across microservices sharing the same token issuer.