CVE-2016-10321

CVE-2016-10321 describes a critical vulnerability in web2py versions prior to 2.14.6, where the application fails to properly enforce host denial before password verification. This flaw enables remote attackers to conduct brute-force attacks against user credentials. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low attack complexity, potentially leading to full compromise of confidentiality, integrity, and availability. Despite its high severity, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.