CVE-2016-3953: web2py Remote Code Execution via Hardcoded Encryption Key
Summary
CVE-2016-3953: web2py remote code execution via hardcoded encryption key in session.connect function. Affects web2py versions < 2.14.2. Fixed in 2.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
web2py is a popular open-source web application framework written in Python. It allows developers to build web applications quickly and easily, providing features such as a built-in web server, a web-based interface for administration, and support for various databases. However, prior to version 2.14.2, web2py contained a critical vulnerability that could allow remote attackers to execute arbitrary code due to a hardcoded encryption key used in the session management.
Vulnerability Detail
The vulnerability arises from the use of a hardcoded encryption key in the session.connect function of web2py versions before 2.14.2. This flaw can be exploited by remote attackers to execute arbitrary code on the server, potentially leading to unauthorized access, data breaches, and complete system compromise. The technical aspect of this vulnerability lies in the predictable nature of the encryption key, which can be leveraged by attackers to manipulate session data.
How To Fix
Latest published version: 2.1.1 as of 23 Oct 2026
pip install --upgrade "web2py==2.1.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.2
This is the first release that contains the fix.
pip install --upgrade "web2py==2.14.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing additional security measures such as restricting access to the web application, using a firewall, and monitoring logs for suspicious activity. However, these are not substitutes for updating the software.
Conclusion
In summary, CVE-2016-3953 is a critical vulnerability in web2py that allows remote code execution due to a hardcoded encryption key. It is crucial for users of web2py to upgrade to version 2.14.2 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your applications.
See every vulnerability recorded for web2py →
FAQ
CVE-2016-3953 is a vulnerability in web2py that allows remote code execution due to a hardcoded encryption key in the session management function.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access, data breaches, and the execution of arbitrary code on the server, compromising the entire application.
Yes, the vulnerability has been patched in web2py version 2.14.2. It is recommended to upgrade to this version or later.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for web2py.
