Which versions of Perry are affected by EUVD-2026-37126?

Perry's authentication system (versions before 0.5.1166) fails to enforce token expiration, allowing perpetual access with any captured bearer token.. A patch is available.

How to fix or mitigate EUVD-2026-37126?

24 hours: Identify all Perry installations and current versions; audit recent token issuance and access logs for potential compromise; notify users of the vulnerability and recommend password changes. 7 days: Implement emergency token revocation for all existing tokens and mandate immediate re-authentication; deploy monitoring for suspicious token replay or access anomalies; contact Perry vendor for patch timeline and interim guidance. 30 days: Apply Perry version 0.5.1166 or later when vendor releases patch; perform full authentication and access audit; implement stronger token management practices and shorter TTLs.

Perry EUVD-2026-37126

Q: What is the CVSS score of EUVD-2026-37126?

EUVD-2026-37126 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-53776 CRITICAL

Insufficient Session Expiration (CWE-613)

2026-06-16 VulnCheck

Authentication Bypass Perry

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-reachable JWT endpoint, no privileges or interaction needed once a prior token is held; full confidentiality and integrity impact via account takeover, no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 16, 2026 - 18:01 EUVD

Analysis Generated

Jun 16, 2026 - 17:15 vuln.today

DescriptionCVE.org

Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = false in the verify_decode helper within the stdlib JWT verification path. Attackers in possession of a previously issued bearer token can present expired tokens to any jwt.verify() call and retain authenticated access indefinitely, bypassing force-expired sessions such as user logout or administrative revocation.

AnalysisAI

Authentication bypass in Perry versions before 0.5.1166 allows remote attackers holding any previously issued bearer token to maintain authenticated access indefinitely, including after logout or administrative revocation. The flaw stems from hardcoded validate_exp=false logic in the stdlib JWT verification path, neutralizing token expiration entirely. No public exploit identified at time of analysis, but the trivial nature of replaying captured tokens against jwt.verify() calls makes this a high-priority fix.

Technical ContextAI

Perry (cpe:2.3:a:perryts:perry) is a TypeScript-based application platform that wraps JWT-based session handling through a stdlib verify_decode helper. The root cause is CWE-613 (Insufficient Session Expiration): the helper unconditionally sets the jsonwebtoken validate_exp option to false, meaning the 'exp' claim inside the JWT payload is never compared against the current time. As a result, every downstream jwt.verify() call in the application - regardless of caller intent - accepts arbitrarily aged tokens as valid, breaking the contract that short-lived bearer tokens provide a bound on session lifetime.

RemediationAI

Vendor-released patch: Perry 0.5.1166 - upgrade immediately per the GitHub Security Advisory GHSA-5324-c68v-8w62 (https://github.com/PerryTS/perry/security/advisories/GHSA-5324-c68v-8w62) and release notes (https://github.com/PerryTS/perry/releases/v0.5.1166). Because the vulnerability invalidates session revocation, operators should also rotate the JWT signing secret/key after upgrading so that any tokens issued during the vulnerable window are cryptographically invalidated; note that this will force all users to re-authenticate. If immediate upgrade is impossible, a compensating control is to wrap or monkey-patch verify_decode (or the stdlib JWT path it calls) to explicitly re-check the exp claim against current time before trusting the decoded payload, and to shorten gateway-level session TTLs at a reverse proxy - be aware this only mitigates app-layer reuse and does not fix any downstream consumer that calls jwt.verify() directly.