CVE-2026-53776

Vulnerability

The JWT validation module in Perry before version 0.5.1166 contains a critical flaw in the verify_decode helper function (crates/perry-stdlib/src/jsonwebtoken.rs:355-358). The helper unconditionally sets validation.validate_exp = false, instructing the underlying jsonwebtoken Rust crate to ignore the exp claim entirely [1][3]. This means any call to jwt.verify() in a Perry application accepts tokens with any expiration value, including tokens whose expiry is years in the past. All JWT verification paths share this single helper, and there is no opt-in or opt-out mechanism to enforce expiration [1].

Exploitation

An attacker needs only a previously issued bearer token (e.g., one captured during normal user authentication or leaked from a session). Without needing any additional credentials or access, the attacker can present the expired token to any Perry endpoint that relies on jwt.verify(). The token is accepted as valid as long as its cryptographic signature is correct [1][3]. No user interaction or race condition is required; the attack is straightforward by sending the expired token in an HTTP Authorization header or similar.

Impact

Successful exploitation allows the attacker to retain authenticated access indefinitely, bypassing all session expiration mechanisms, including user logout, forced session revocation, and administrative revocations [1][3]. This effectively breaks the authentication control provided by JWT expiry, potentially leading to full compromise of the affected application and its data. The confidentiality, integrity, and availability of the application are at high risk, as the attacker can perform any action permitted by the compromised account's privileges.

Mitigation

The vulnerability is fixed in Perry version 0.5.1166 [2]. Users should immediately upgrade to this version or later. There is no known workaround for affected versions; the fix corrects the unconditional validate_exp = false setting to allow expiration validation by default, aligning with the Node.js jsonwebtoken package behavior [1]. Users should verify they are running at least v0.5.1166 to ensure session expiration is properly enforced.