CVE-2016-3953

web2py remote code execution via hardcoded encryption key in session.connect function

9.8 CriticalFix available

CVE-2016-3953 is a critical vulnerability (CVSS 9.8) in Web2py, published February 6, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.34%, the 88th percentile. Fixed in web2py 2.14.2.

The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the session.connect function.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.34%Down 2.3 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2016-3953
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-798
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-3953
Updated: 2026-11-02

EUVDEUVD-2022-4863 No score

Record: EUVD-2022-4863
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q2rq-qgcf-m22w 9.8

web2py remote code execution via hardcoded encryption key in session.connect function

Record: GHSA-q2rq-qgcf-m22w
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-798
Updated: 2026-11-02

OSV 9.8

Record: CVE-2016-3953
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-q2rq-qgcf-m22w 9.8

web2py remote code execution via hardcoded encryption key in session.connect function

Record: GHSA-q2rq-qgcf-m22w
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-798
Updated: 2026-11-02

OSVPYSEC-2026-570 9.8

web2py remote code execution via hardcoded encryption key in session.connect function

Record: PYSEC-2026-570
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-3953 9.8

Record: UBUNTU-CVE-2016-3953
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUSN-4030-1 No score

web2py vulnerabilities

It was discovered that web2py does not properly check denied hosts before verifying passwords. An attacker could possibly use this issue to perform brute-force attacks. (CVE-2016-10321)

It was discovered that web2py allows remote attackers to obtain environment variable values. An attacker could possibly use this issue to gain administrative access. (CVE-2016-3952)

It was discovered that web2py uses a hardcoded encryption key. An attacker could possibly use this issue to execute arbitrary code. (CVE-2016-3953, CVE-2016-3954, CVE-2016-3957)

Record: USN-4030-1
Updated: 2026-11-02

Affected products

web2py

Affected packages

Affected packages
Package	Affected	Fixed
`web2py` PyPI	before 2.14.2	2.14.2
`web2py` PyPI	before 2.14.2, plus listed versions 1.96.41.98.22.1.1	2.14.2
`web2py` Ubuntu:16.04:LTS	before 2.12.3-1ubuntu0.1, plus listed versions 1.99.7-12.12.3-1	2.12.3-1ubuntu0.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 10 moreShow less