Advisory Weakness Curation

web2py is vulnerable to password brute-force attack web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.

Improper Restriction of Excessive Authentication Attempts web2py does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.