CVE-2026-111675: Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Q: What does an attacker need to exploit this issue?

The attacker needs to know the victim's phone number or email address. They can trigger a verification code and then brute-force the six-digit code against password-reset or verification-login endpoints while rotating source IP addresses.

Q: Are unauthenticated attackers able to exploit it?

Yes. Exploitation does not require authentication or user interaction. Successful brute forcing can allow an attacker to take over the targeted account.

Q: What makes brute forcing the verification code practical?

Verification codes are six digits and are neither invalidated nor protected by attempt limits. This allows repeated guesses, including from rotating IP addresses.

Q: Which versions should be considered affected?

Course-tencent-cloud through version 2.0.1 is affected. The provided information does not identify a fixed version.

Published Oct 16, 2026

Updated

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.

Affected Software

1 affected component

Course-tencent-cloud<=2.0.1

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to know the victim's phone number or email address. They can trigger a verification code and then brute-force the six-digit code against password-reset or verification-login endpoints while rotating source IP addresses.

Are unauthenticated attackers able to exploit it?

Yes. Exploitation does not require authentication or user interaction. Successful brute forcing can allow an attacker to take over the targeted account.

What makes brute forcing the verification code practical?

Verification codes are six digits and are neither invalidated nor protected by attempt limits. This allows repeated guesses, including from rotating IP addresses.

Which versions should be considered affected?

Course-tencent-cloud through version 2.0.1 is affected. The provided information does not identify a fixed version.

CVE-2026-111675: Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Are unauthenticated attackers able to exploit it?

What makes brute forcing the verification code practical?

Which versions should be considered affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Are unauthenticated attackers able to exploit it?

What makes brute forcing the verification code practical?

Which versions should be considered affected?