Key points
- CVE-2026-111675 affects Course-Tencent-Cloud through version 2.0.1.
- The vulnerability carries a CVSS score of 9.1, rated Critical.
- The source material does not state whether a fix exists.
The Course-Tencent-Cloud plugin contains a severe authentication flaw that allows remote attackers to hijack user accounts. This issue affects all versions up to and including 2.0.1, with the source material providing no information on available remediation.
What happened
The National Vulnerability Database records CVE-2026-111675 as a critical severity issue within the Course-Tencent-Cloud software. The flaw stems from improper restrictions on authentication attempts, specifically regarding six-digit verification codes sent via SMS or email. These codes are never invalidated after use, nor are there any limits on the number of attempts allowed to guess them. An attacker does not need valid credentials to begin this process. They only need to know the victim's phone number or email address to trigger the code generation mechanism.
Why it matters
Security teams must prioritise this issue because the attack vector requires no initial access to the system. According to the NVD record, attackers can rotate source IP addresses to avoid detection while targeting the password reset and verify login endpoints. This allows them to brute force the six-digit codes systematically. Once a code is guessed, the attacker can reset the password and take over the account. The lack of attempt limits makes this exploitation trivial for any actor with the target's contact details.
What happens next
Organisations using this plugin should immediately assess their exposure. Check whether any instances are running version 2.0.1 or earlier. Monitor logs for unusual volumes of SMS or email verification requests from single users. Consider disabling the password reset feature temporarily if the plugin cannot be removed. Await official guidance from the vendor regarding a remediation update.
Patch priority
Teams usually begin by identifying all environments hosting the affected software versions. It is prudent to isolate exposed systems from public networks where possible to reduce the attack surface. Verify whether the plugin is actively used by legitimate users before considering removal. Back up configuration files and database states prior to making any changes. If the vendor releases an update, test it in a non-production environment first. Roll out the fix to critical systems before extending it to less sensitive areas.
What to do and how to stay safe: Course-Tencent-Cloud
- Audit your inventory to confirm if Course-Tencent-Cloud versions up to 2.0.1 are deployed.
- Monitor authentication logs for spikes in verification code requests from specific endpoints.
- Implement additional monitoring for account takeover indicators such as password resets.
- Wait for the vendor to provide an official update before applying any unverified patches.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Course-Tencent-Cloud are affected by CVE-2026-111675?
All versions of the plugin up to and including version 2.0.1 are affected.
Is there a patch available for this vulnerability?
The source material does not state whether a fix or patch exists.
What is the CVSS score for this issue?
The National Vulnerability Database rates the severity as 9.1, which is Critical.
