CVE-2016-3953: web2py Remote Code Execution via Hardcoded Encryption Key
Summary
CVE-2016-3953: web2py remote code execution via hardcoded encryption key in session.connect function. Affects web2py versions < 2.14.2. Fixed in 2.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
web2py is a Python web framework that allows for rapid development of secure web applications. It provides a high-level interface for handling common web development tasks and includes built-in security features. However, a vulnerability in versions prior to 2.14.2 allows for remote code execution due to the use of a hardcoded encryption key in the session.connect function.
Vulnerability Detail
The vulnerability arises from the use of a hardcoded encryption key in the session.connect function of web2py. This key is used for encrypting session data, but its hardcoded nature makes it predictable and exploitable by attackers. By leveraging this vulnerability, remote attackers can execute arbitrary code on the affected system. The impact of this vulnerability is severe, as it allows for unauthorized access and potential compromise of the web application and its underlying infrastructure.
How To Fix
Latest published version: 2.1.1 as of 23 Oct 2026
pip install --upgrade "web2py==2.1.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.2
This is the first release that contains the fix.
pip install --upgrade "web2py==2.14.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of web2py to address the issue.
Conclusion
The vulnerability in web2py versions prior to 2.14.2 allows for remote code execution due to the use of a hardcoded encryption key. To mitigate this issue, it is crucial to upgrade to web2py version 2.14.2 or later. This upgrade removes the vulnerability and ensures the security of the web application. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for web2py →
FAQ
web2py is a Python web framework that simplifies web application development and includes built-in security features.
The vulnerability allows for remote code execution, enabling attackers to execute arbitrary code on the affected system and potentially compromise the web application and its infrastructure.
To fix this vulnerability, upgrade to web2py version 2.14.2 or later, which removes the use of the hardcoded encryption key.
No, there is no known workaround. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the official web2py documentation and the CVE entry (CVE-2016-3953).
References
Related vulnerabilities
Recent vulnerabilities recorded for web2py.
