CVE-2026-111675 — Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/ema…
Published: 2026-10-16 · CVSS: 9.1 · CVSS 4.0
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7