CVE-2016-10321: web2py Vulnerable to Password Brute-Force Attack
Summary
CVE-2016-10321: web2py is vulnerable to password brute-force attack. Affects web2py versions < 2.14.6. Fixed in 2.14.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
web2py is a popular open-source web application framework written in Python. It allows developers to build web applications quickly and efficiently, providing features such as a built-in ticketing system, a web-based interface, and support for multiple databases. However, prior to version 2.14.6, web2py had a security flaw that made it susceptible to brute-force attacks on user passwords, potentially compromising user accounts.
Vulnerability Detail
The vulnerability arises from web2py's failure to adequately check if a host is denied access before allowing password verification attempts. This oversight enables remote attackers to launch brute-force attacks, systematically trying different password combinations until they gain unauthorized access. The implications of this vulnerability are severe, as it could lead to unauthorized access to user accounts, data breaches, and exploitation of sensitive information.
How To Fix
Latest published version: 2.1.1 as of 23 Oct 2026
pip install --upgrade "web2py==2.1.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.6
This is the first release that contains the fix.
pip install --upgrade "web2py==2.14.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement IP address blocking or rate limiting on your web server to mitigate the risk of brute-force attacks until you can update to the patched version.
Conclusion
In summary, CVE-2016-10321 represents a significant security vulnerability in web2py that allows for password brute-force attacks. It is crucial for users of affected versions to update to version 2.14.6 or later to protect against potential unauthorized access. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for web2py →
FAQ
CVE-2016-10321 is a vulnerability identifier for a security flaw in web2py that allows remote attackers to perform brute-force password attacks.
If your application uses an affected version of web2py, it may be at risk of unauthorized access due to brute-force attacks on user passwords.
If an immediate update is not possible, consider implementing IP address blocking or rate limiting to reduce the risk of brute-force attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for web2py.
