Improper Authentication Attempts Lead to Account Takeover in Course Tencent Cloud by Tencent

CVE-2026-111675

What is CVE-2026-111675?

The Course Tencent Cloud up to version 2.0.1 is affected by a vulnerability that allows unauthenticated attackers to exploit improper restrictions on authentication attempts. This flaw enables attackers to carry out brute force attacks on 6-digit SMS and email verification codes, which are not invalidated or limited in their attempts. By triggering a verification code to a victim’s phone or email, attackers can leverage this weakness to rotate their source IP addresses and target the password reset and login verification endpoints, facilitating potential account takeovers.

References