CVE-2026-111675: Improper Restriction of Excessive Authentication Attempts in xiaochong0302 course-tencent-cloud

The vulnerability in course-tencent-cloud versions up to 2.0.1 involves improper restriction of excessive authentication attempts. Specifically, 6-digit SMS/email verification codes used for password reset and login verification are not invalidated after use nor limited in the number of attempts, allowing unauthenticated attackers to brute force these codes. Attackers can exploit this by triggering a verification code for a victim's phone or email and then attempting to guess the code by rotating source IP addresses to bypass rate limiting, resulting in account compromise.

Successful exploitation allows unauthenticated attackers to take over user accounts by brute forcing verification codes without limitation or invalidation. This compromises account security and user data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to password reset and verification endpoints, implement rate limiting, and monitor for suspicious activity related to authentication attempts.