CVE-2026-53776: Critical JWT Bypass in Perry Allows Remote Authentication Evasion

Overview

CVE-2026-53776 is a critical vulnerability affecting Perry, an open-source project maintained on GitHub, in all versions prior to 0.5.1166. The flaw is classified under CWE-613 (Insufficient Session Expiration) and stems from an unconditional bypass in the application's JSON Web Token (JWT) validation logic. In practical terms, the code responsible for checking whether a token has expired can be circumvented, meaning a token that should be rejected as stale is instead accepted as valid — granting an attacker persistent, unauthorized access long after a session should have terminated.

Why This Matters Right Now

Despite being published on June 16, 2026, this vulnerability has already reached a dangerous operational status with very little time between disclosure and weaponization. The exploit maturity is currently rated weaponized, and exploit activity was detected as early as June 16, 2026 at 18:22 UTC — less than two hours after the CVE was first published. This near-zero-day exploitation window is a strong signal that threat actors were either monitoring disclosure channels closely or had pre-existing knowledge of the flaw.

Exploit references have surfaced on both GitHub and Exploit-DB, further confirming that working exploit code is in active circulation. Organizations running any affected version of Perry should treat this as an actively exploited vulnerability regardless of CISA KEV listing status.

Attack Surface Analysis

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N paints a stark picture of the attack surface:

• Attack Vector: Network — The vulnerability is fully remotely exploitable over any network-accessible instance of Perry. No local or adjacent network access is required.
• Attack Complexity: Low — Exploitation does not require special conditions, race conditions, or complex preparation. Any attacker with HTTP access to the target can attempt this.
• Privileges Required: None — An attacker needs no pre-existing account or credential to initiate exploitation, drastically widening the potential attacker pool.
• User Interaction: None — The attack is entirely server-side. No victim action, click, or session is required to trigger the vulnerability.
• Confidentiality & Integrity Impact: High — A successful exploit can expose sensitive data and allow unauthorized modification of resources, while availability remains unaffected by this specific vector.

The combination of network reachability, no authentication barrier, and low complexity earns this flaw its CVSS score of 9.1 and CRITICAL severity rating. Any internet-exposed Perry deployment running a version below 0.5.1166 should be considered compromised until proven otherwise.

Threat Actor Association

No specific named threat actors or groups have been attributed to active exploitation of CVE-2026-53776 at this time. However, given the weaponized exploit maturity and the speed of post-disclosure exploitation, opportunistic scanning and automated exploitation attempts are highly probable.

Remediation Guidance

Defenders should act immediately. The following steps are strongly recommended:

• Identify exposure: Audit all deployments of Perry across your environment and verify the installed version. Any version below 0.5.1166 is vulnerable.
• Monitor for a patch: As of the last data update on June 16, 2026, no official patch has been confirmed available. Track the Perry GitHub releases page closely for remediation updates.
• Apply compensating controls: Until a patch is confirmed, consider placing Perry instances behind an authenticated reverse proxy, enforcing network-layer access controls (firewalls, VPN-only access), and invalidating all active JWT sessions as a precaution.
• Review access logs: Given the exploitation timeline, investigate JWT-related authentication events from June 16, 2026 onward for signs of token reuse or anomalous session persistence.
• Implement JWT validation hardening: Ensure any custom middleware or wrapper around Perry's auth layer independently validates token expiration (exp claim) as a defense-in-depth measure.

Stay Informed

CVE-2026-53776 is a clear example of how rapidly the threat landscape evolves — from disclosure to weaponized exploit in under two hours. Track this CVE and stay ahead of emerging threats by visiting sec.kaitan.id, where our team continuously monitors, analyzes, and publishes intelligence on critical vulnerabilities as they develop.