course-tencent-cloud: Improper restriction of authentication attempts

Summary

course-tencent-cloud through version 2.0.1 does not limit verification attempts for SMS and email codes. The 6-digit codes are never invalidated, so an unauthenticated attacker who knows a victim's phone number or email address can brute-force a code and take over the account. The attack works against the password reset and login verification endpoints, and the attacker can rotate source IP addresses to evade simple IP-based limits.

Affected

• xiaochong0302 course-tencent-cloud, versions 0 to 2.0.1 (inclusive)
• Default configuration is reported as unaffected by the CVE record; affected deployments are those with the vulnerable code

Fixed in

Unknown. No fixed version or vendor advisory has been published.

Workaround

• No vendor guidance found.
• Enforce server-side attempt limits per account and invalidate a code after a few wrong guesses.
• Rate-limit per target account and phone or email, not only per IP.
• Shorten code lifetime and alert on repeated reset or verification requests for one account.
• Place login and reset endpoints behind MFA or an identity provider where possible.
• A WAF or reverse-proxy rule can serve as a temporary stopgap only.

Exploitation

• CISA SSVC data lists exploitation status as poc (public proof of concept available); automatable: no; technical impact: total.
• No reports of exploitation in the wild found.
• One aggregator lists the CVE as not in KEV.

Our recommendation

• Identify all installations of course-tencent-cloud, including Docker images, and confirm the version.
• Check whether login and password reset endpoints are reachable from the internet.
• Apply server-side attempt limits or take the service offline until a fix is available.
• Monitor the project repository and the CVE record for a fix, and plan migration if the project remains unpatched.
• Review account activity for unexpected password resets, since account takeover may affect admin accounts and personal data.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• HackMD write-up hackmd.io
• Verify.php at v2.0.1 github.com
• PasswordReset.php at v2.0.1 github.com
• VulDB CVE-2026-111675 vuldb.com
• CVE record (CVelistV5 JSON) raw.githubusercontent.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:24.