CVE-2026-111675: falha crítica em xiaochong0302 course-tencent-cloud
Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.5%
Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
xiaochong0302 · course-tencent-cloudReferências
https://github.com/xiaochong0302/course-tencent-cloud/blob/v2.0.1/app/Services/Logic/Account/PasswordReset.phphttps://github.com/xiaochong0302/course-tencent-cloud/blob/v2.0.1/app/Services/Verify.php#L27-L73https://hackmd.io/@hieuPenguinnn/ctc-verify-code-brute-force-account-takeoverhttps://www.vulncheck.com/advisories/course-tencent-cloud-through-2.0.1-verification-code-brute-force-account-takeover