Course-Tencent-Cloud Critical SMS Brute-Force Flaw CVE-2026-111675 Affects v2.0.1

The Course-Tencent-Cloud plugin contains a severe authentication failure that permits unrestricted attempts to guess verification codes. According to the NVD record, this issue exists in versions 2.0.1 and earlier. An attacker does not need valid credentials to initiate the attack process against a target system.

The risk

The vulnerability stems from improper restriction of authentication attempts, classified under CWE-307. An unauthenticated adversary can trigger the generation of six-digit codes sent via SMS or email. The system fails to invalidate these codes after use and does not limit the number of guesses allowed. This design permits continuous rotation of source IP addresses against the password reset and verify login endpoints.

Who is exposed

Users running xiaochong0302’s Course-Tencent-Cloud plugin through version 2.0.1 are directly affected. Any environment where an attacker knows a victim’s phone number or email address is at risk. The ability to rotate source IPs helps attackers evade basic rate-limiting controls that might otherwise block rapid-fire requests from a single network location.

Cost and compliance

The National Vulnerability Database assigns a CVSS score of 9.1 to this issue, marking it as critical. This rating reflects the ease of exploitation and the high impact of unauthorized access. Organizations must evaluate their exposure based on the version of the plugin currently deployed in their web environments.

What to watch

Managers should verify the installed version of the Course-Tencent-Cloud plugin immediately. If the version is 2.0.1 or lower, the system is vulnerable to the described brute-force attack. Monitor for unexpected password reset requests or login attempts from diverse geographic locations, which may indicate an ongoing exploitation attempt against user accounts.

Signals worth monitoring

Teams usually review authentication logs for bursts of failed verification attempts from multiple IP addresses. Check whether the system records source IPs for each guess to identify rotation patterns typical of distributed brute-force attacks. Look for spikes in SMS or email delivery notifications that do not correspond to legitimate user activity. First containment moves often involve temporarily disabling the affected login endpoints or implementing emergency rate-limiting rules at the firewall level to stop the traffic flow.

What to do and how to stay safe: Course-Tencent-Cloud

• Audit your plugin inventory to confirm if Course-Tencent-Cloud version 2.0.1 or earlier is installed.
• Monitor server logs for high volumes of failed verification attempts from rotating IP addresses.
• Enforce strict rate-limiting on all authentication and password reset endpoints to slow down attackers.
• Wait for the vendor to provide a security update before restoring full access to the affected endpoints.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Course-Tencent-Cloud are vulnerable to this brute-force attack?

Versions 2.0.1 and earlier of the Course-Tencent-Cloud plugin are affected by this vulnerability.

What is the CVSS score for CVE-2026-111675?

The National Vulnerability Database rates CVE-2026-111675 with a CVSS score of 9.1, which is critical.

How do attackers exploit the lack of attempt limits?

Attackers trigger verification codes and rotate source IPs to guess the six-digit codes against login endpoints.