diff --git a/server/auth.mjs b/server/auth.mjs
index ed943fc..e27a5da 100644
--- a/server/auth.mjs
+++ b/server/auth.mjs
@@ -54,7 +54,7 @@ export function verifyToken(token) {
   }
   try {
     const body = JSON.parse(Buffer.from(data.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString());
-    if (body.exp && body.exp < Math.floor(Date.now() / 1000)) return null;
+    if (!Number.isSafeInteger(body.exp) || body.exp <= Math.floor(Date.now() / 1000)) return null;
     return body;
   } catch {
     return null;