CVE-2026-111675 in Course-Tencent-Cloud
Summary
by MITRE • 10/16/2026
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Course-tencent-cloud versions up to 2.0.1 represents a critical failure in implementing robust authentication controls, specifically falling under the category of Improper Restriction of Excessive Authentication Attempts as defined by CWE-307. This flaw fundamentally undermines the security model designed to protect user accounts through multi-factor verification mechanisms involving SMS or email codes. The core technical issue lies in the server-side logic governing these verification endpoints, which fails to enforce rate limiting on a per-user basis and lacks any mechanism for code expiration or invalidation after use. Consequently, an attacker who possesses valid target identifiers such as a phone number or email address can initiate repeated requests to generate new verification codes without triggering standard anti-brute-force protections like account lockouts or CAPTCHA challenges.
From an operational perspective, this vulnerability allows unauthenticated actors to perform efficient brute force attacks against six-digit alphanumeric or numeric codes. Given the relatively small entropy of a six-character code space, which offers only one million possible combinations, the absence of attempt limits makes it computationally trivial for automated tools to guess the correct code within seconds or minutes by rotating source IP addresses to evade basic network-level rate limiting. The attacker can systematically iterate through potential codes against password reset and verify login endpoints until a match is found. This process does not require prior authentication credentials, making it accessible to any external actor with knowledge of the victim's contact information.
The impact of this vulnerability extends beyond simple unauthorized access; it facilitates complete account takeover (ATO). Once an attacker successfully guesses or brute forces the verification code, they can reset passwords for affected accounts or bypass login screens entirely. This leads to severe confidentiality and integrity breaches, including exposure of sensitive personal data, financial loss if payment methods are stored, and potential misuse of the compromised identity for further social engineering attacks against other users within the platform. The lack of session invalidation means that even if a code is used legitimately by the victim, it may remain valid or easily guessable again, complicating remediation efforts post-incident.
To mitigate this vulnerability, immediate implementation of strict rate limiting on all authentication-related endpoints is required. This should include both IP-based throttling and more importantly, user-centric limits that restrict the number of verification codes sent to a specific phone number or email address within a defined time window. Additionally, security controls must enforce short expiration times for generated codes, typically no longer than five minutes, and ensure immediate invalidation upon successful use. Implementing CAPTCHA challenges after a minimal number of failed attempts can further deter automated brute force tools. Long-term remediation should involve adopting industry-standard frameworks such as the OWASP Authentication Cheat Sheet to review and harden all authentication flows against common attack vectors including credential stuffing and brute forcing.