CVE-2016-10321: web2py Password Brute-Force Attack Vulnerability
Summary
CVE-2016-10321: web2py is vulnerable to password brute-force attack. Affects web2py versions < 2.14.6. Fixed in 2.14.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
web2py is a Python web framework that allows for rapid development of secure web applications. It provides a high-level interface for building web applications and includes features such as an ORM, a templating engine, and a web server. However, versions of web2py before 2.14.6 are vulnerable to a password brute-force attack. This vulnerability arises from a failure to properly check if a host is denied before verifying passwords, enabling remote attackers to perform brute-force attacks.
Vulnerability Detail
The vulnerability in web2py allows remote attackers to launch password brute-force attacks. By exploiting this vulnerability, an attacker can repeatedly attempt to guess a user's password by systematically trying different combinations until the correct one is found. This can lead to unauthorized access to user accounts and potentially compromise sensitive information. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 2.1.1 as of 23 Oct 2026
pip install --upgrade "web2py==2.1.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.6
This is the first release that contains the fix.
pip install --upgrade "web2py==2.14.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of web2py to mitigate the risk of password brute-force attacks.
Conclusion
web2py versions before 2.14.6 are vulnerable to a password brute-force attack. To mitigate this vulnerability, users should upgrade to the latest version of web2py. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for web2py →
FAQ
web2py is a Python web framework that facilitates the development of secure web applications. It provides a high-level interface and includes features such as an ORM and a templating engine.
A password brute-force attack is a method used by attackers to systematically guess a user's password by trying different combinations until the correct one is found.
This vulnerability can lead to unauthorized access to user accounts and potential compromise of sensitive information.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
To fix this vulnerability, it is recommended to upgrade to web2py version 2.14.6 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for web2py.
