{"id":"CVE-2026-111675","kind":"vulnerability","aliases":["CVE-2026-111675"],"related":[],"title":"Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that…","description":"Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.","summary":"course-tencent-cloud (xiaochong0302, PHP Phalcon course LMS) through 2.0.1 issues 6-digit SMS/email codes cached 300s. Checking the code never deletes it or counts attempts, and the password-reset and login-by-verify endpoints have no captcha. The only throttle is per-IP, default 900 requests per 900s, so an attacker rotating IPs can cover all 10^6 codes in one window. Needs the victim's phone or email and one captcha-solved code send. Results in account takeover.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"course-tencent-cloud","fixed":[],"affected":"<= 2.0.1","ecosystem":"github"}],"ecosystems":[],"tags":["account-takeover","brute-force","course-tencent-cloud","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"Check installed version (release tag or git describe) is <= 2.0.1. Inspect app/Services/Verify.php: if checkSmsCode/checkMailCode only compare to the cached value with no delete or attempt counter, you are exposed. Review security.throttle settings (default 900/900s per IP) and web logs for many POSTs to /api/account/password/reset and /api/account/verify/login.","fix":"No fixed release identified as of 2026-10-23 (unknown; check upstream xiaochong0302/course-tencent-cloud for a release after 2.0.1). Interim: add a WAF/reverse-proxy rate limit keyed on the target account on the reset and verify-login endpoints, lower security.throttle rate_limit, or patch Verify.php to delete the code after N failed attempts and after successful use.","status":"open","published_at":"2026-10-16T18:17:50+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:13:37+00:00","updated_at":"2026-10-23T23:29:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:13:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","impact":"high","summary":"Course-tencent-cloud through version 2.0.1 does not limit verification-code attempts on its password reset and login endpoints, and the codes are never invalidated. An unauthenticated attacker who knows a victim's phone number or email can brute-force the 6-digit code and take over the account.","category":"package","who_cares":["course-tencent-cloud","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over user accounts by brute-forcing SMS or email codes","analyst_note":"Sources give no patched version or config fix; check the upstream repository and NVD entry for a fixed release and whether a rate limit or code expiry was added.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000443,"input_tokens":2795,"output_tokens":328,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give no patched version or config fix; check the upstream repository and NVD entry for a fixed release and whether a rate limit or code expiry was added.","search":"'-111675':17A,20A '-2026':16A,19A '10':100B '2.0.1':6A,49B,129C '300s':56B '6':51B,101B,145C '900':88B '900s':91B 'account':26B,122B,186C 'account-takeov':25B 'allow':139C 'attack':94B,141C,158C 'attempt':13A,65B,136C,156C 'attempt-limit':155C 'authent':12A,135C 'brute':29B,143C 'brute-forc':28B 'cach':55B 'captcha':79B,116B 'captcha-solv':115B 'check':57B 'cloud':4A,24A,34B,42B,127C 'code':54B,59B,102B,118B,149C,170C 'contain':7A,130C 'count':64B 'cours':2A,32B,40B,46B,125C 'course':22A 'course-tencent-cloud':1A,21A,31B,39B,124C 'cover':98B 'cve':15A,18A 'default':87B 'delet':61B 'digit':52B,146C 'email':112B,166C 'endpoint':76B,182C 'forc':30B,144C 'host':38B 'improp':9A,132C 'invalid':153C 'ip':86B,96B,174C 'issu':50B 'know':160C 'limit':157C 'lms':47B 'login':73B,181C 'login-by-verifi':72B 'need':106B 'never':60B,152C 'one':104B,114B 'packag':35B 'password':69B,177C 'password-reset':68B 'per':85B,90B 'per-ip':84B 'phalcon':45B 'phone':110B,164C 'php':44B 'request':89B 'reset':70B,178C 'restrict':10A,133C 'result':120B 'rotat':95B,172C 'self':37B 'self-host':36B 'send':119B 'sms/email':53B,147C 'solv':117B 'sourc':173C 'take':184C 'takeov':27B,123B 'tencent':3A,23A,33B,41B,126C 'throttl':82B 'trigger':168C 'unauthent':140C 'verif':148C 'verifi':75B,180C 'victim':108B,162C 'vulner':14A,137C 'window':105B 'xiaochong0302':43B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111675","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111675","severity":null,"published_at":"2026-10-16T18:17:50+00:00","modified_at":"2026-10-19T14:16:59+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111675:456","url":null,"severity":null,"published_at":"2026-10-23T23:29:53+00:00","modified_at":"2026-10-23T23:29:55+00:00","first_seen_at":"2026-10-23T23:29:53+00:00","fetched_at":"2026-10-23T23:29:55+00:00","note":"Correction: default config is affected (default throttle is per-IP only); removed default-config from not-affected-if."}],"documents":[{"id":2002,"url":"https://hackmd.io/@hieuPenguinnn/ctc-verify-code-brute-force-account-takeover","title":"course-tencent-cloud account takeover through brute force of verification code (hieuPenguinnn)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2003,"url":"https://www.vulncheck.com/advisories/course-tencent-cloud-through-2.0.1-verification-code-brute-force-account-takeover","title":"VulnCheck: Course-tencent-cloud through 2.0.1 Verification Code Brute Force","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2005,"url":"https://github.com/xiaochong0302/course-tencent-cloud/blob/v2.0.1/app/Services/Verify.php","title":"Verify.php at v2.0.1 (vulnerable code)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2006,"url":"https://github.com/xiaochong0302/course-tencent-cloud/releases","title":"course-tencent-cloud releases","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}