Tokens don't expire, and expiry is an optional, user-supplied input

[micolous]

Both TokenGenerator and AdvancedTokenGenerator optionally set a token expiry timestamp based on the validity_timestamp query parameter:

Jitsi-SAML2JWT/src/classes/TokenGenerator.class.php

Lines 55 to 58 in 5a38452

	if (array_key_exists('validity_timestamp',$requestData))
	$validity=intval($requestData['validity_timestamp']);
	else
	$validity=0;

Jitsi-SAML2JWT/src/classes/TokenGenerator.class.php

Lines 80 to 81 in 5a38452

	if ($validity>0)
	$payload['exp']=$validity;

This doesn't appear to be set as part of normal request flows, so tokens never expire by default.

The exp field should be set on based on a server-side configuration option, and not in response to user-supplied inputs.