CVE-2026-111675

Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

9.1 Critical

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.53%Up 0.1 points since Oct 17, 2026

What each source reports

CVE List Score used 9.1

Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Record: CVE-2026-111675
CVSS 4.0: 9.1 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-307
Updated: 2026-11-02

EUVDEUVD-2026-102966 9.1

Record: EUVD-2026-102966
CVSS 4.0: 9.1 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h2mg-h5vq-xqx3 9.1

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts...

Record: GHSA-h2mg-h5vq-xqx3
CVSS 4.0: 9.1 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-307
Updated: 2026-11-02

NVD 9.1

Record: CVE-2026-111675
CVSS 4.0: 9.1 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-307
Updated: 2026-11-02

OSV 9.1

Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

Record: CVE-2026-111675
CVSS 4.0: 9.1 CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-307
Updated: 2026-11-02

Affected products

xiaochong0302 course-tencent-cloud

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-111675 is a critical vulnerability (CVSS 9.1) in Xiaochong0302 Course-tencent-cloud, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. No source names a fixed version.