Is CVE-2026-111675 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111675?

CVE-2026-111675 has a CVSS v3 severity of HIGH (7.4).

Back

CVE-2026-111675

Description

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.