CVE-2026-53776: Perryts Perry

Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days.

Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = false in the verify_decode helper within the stdlib JWT verification path. Attackers in possession of a previously issued bearer token can present expired tokens to any jwt.verify() call and retain authenticated access indefinitely, bypassing force-expired sessions such as user logout or administrative revocation.

Affected products

• Perryts Perry: before 0.5.1166 (fixed in 0.5.1166)

Published 2026-06-16. Last modified 2026-07-14.