Description (CNA)
Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = false in the verify_decode helper within the stdlib JWT verification path. Attackers in possession of a previously issued bearer token can present expired tokens to any jwt.verify() call and retain authenticated access indefinitely, bypassing force-expired sessions such as user logout or administrative revocation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| PerryTS / perry | affected 0 before 0.5.1166 |
CWE
CWE-613
References
- https://github.com/PerryTS/perry/releases/v0.5.1166
- https://github.com/PerryTS/perry/security/advisories/GHSA-5324-c68v-8w62
- https://www.vulncheck.com/advisories/perry-jwt-expiration-bypass-via-verify-decode
ADP enrichment
No English description supplied.
No references supplied.