CVE-2026-111675 Details

A vulnerability exists in Course-Tencent-Cloud versions through 2.0.1, allowing unauthenticated attackers to brute force 6-digit SMS or email verification codes. These codes are not invalidated or limited in attempts. Attackers can trigger a code to be sent to a victim's phone or email, then rotate source IPs to bypass throttling on the password reset and login verification endpoints, potentially taking over victim accounts.

The verification code should be invalidated after a successful or failed attempt, and a limit should be set on the number of incorrect guesses allowed. Additionally, a captcha should be required on the password reset and login verification endpoints, and the verification code's length or character set should be expanded to prevent brute force attacks. In the medium term, consider implementing a per-account guess counter that is independent of source IP, and use a constant-time comparison method to validate codes.