CRITICAL9.8

PYSEC-2026-569

web2py is vulnerable to password brute-force attack

Quick fix

PYSEC-2026-569 — web2py: upgrade to the fixed version with the command below.

pip install --upgrade 'web2py>=2.14.6'

Details

web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/web2py

Introduced in: 0Fixed in: 2.14.6

Fixpip install --upgrade 'web2py>=2.14.6'

References

https://nvd.nist.gov/vuln/detail/CVE-2016-10321[ADVISORY]
https://github.com/web2py/web2py/issues/1585#issuecomment-284317919[WEB]
https://github.com/web2py/web2py/commit/944d8bd8f3c5cf8ae296fc03d149056c65358426[WEB]
https://github.com/web2py/web2py[PACKAGE]
https://usn.ubuntu.com/4030-1[WEB]
https://pypi.org/project/web2py[PACKAGE]
https://github.com/advisories/GHSA-gv85-wgxc-vc56[ADVISORY]