cve.nowby Sazabi
← All vulnerabilities
CVE-2026-111675

Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: poc
  • Automatable: no
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.

Affected versions

  • xiaochong0302 course-tencent-cloud

    through 2.0.1

References 4

hackmd.io

GitHub · xiaochong0302/course-tencent-cloud

vulncheck.com