CVE-2026-111675 is a high severity (CVSS 7.4) flaw in course-tencent-cloud through 2.0.1. Six digit SMS and email verification codes never expire or limit attempts, so attackers can guess them and take over accounts. The record names no fixed version. The sections below cover affected versions, how to check, and what to do first.
What's affected
course-tencent-cloud 2.0.1 and earlier, per the record and VulnCheck. The weakness affects the password reset and verify login endpoints that use the verification code. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
The attacker needs the victim's phone number or email address. The record says rotating source IP addresses defeats simple per-address limits.
Scoring note: the record's 7.4 is a CVSS 3.1 base score. VulnCheck's advisory also lists 9.1 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Confirm the version you run. Look at your authentication logs for many verify or reset requests against the same account in a short window, especially from varied addresses.
Review recent password resets and look for accounts whose contact details or password changed without a matching support request.
What to do now
- Inventory deployments and versions.
- Add a rate limit per account and per phone or email at your proxy or gateway, not only per IP.
- Cap attempts per code and expire codes after a short time if you can patch locally.
- Review recent password resets and force resets on suspicious accounts.
- Upgrade when a confirmed fix ships.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Keep a record of what you checked and what you changed. Note the version found, the date, the action taken and who approved it. If the advisory is later updated, for example with a fixed release, you will know which systems need another pass, and an auditor or a colleague can follow your reasoning.
Why it matters
This is CWE-307, improper restriction of excessive authentication attempts. A six digit code has one million possibilities. That is fine when a code lasts a few minutes and allows a handful of tries. It is weak when the code never dies and the server accepts unlimited guesses.
The vector rates attack complexity as high, because brute force takes volume and time. That does not make it safe. Automated tools handle volume well, and the account takeover is complete once a code lands. It is not listed in CISA KEV.
Quick check
Why does IP rotation matter?
Limits keyed only on source address reset when the attacker changes address. Limit by account as well.
How long should a code live?
The record gives no figure. A short lifetime with a small attempt cap is the usual control.
Sources
Last reviewed: 18 October 2026.
