Cpe:2.3:a:tencent:course-Tencent-Cloud:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3atencentcourse-tencent-cloud/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 18:49:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgImproper Authentication Rate Limiting in Course-tencent-cloudhttps://feed.craftedsignal.io/briefs/2026-10-cve-2026-111675/Fri, 16 Oct 2026 18:49:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2026-111675/Course-tencent-cloud through version 2.0.1 contains an authentication bypass vulnerability allowing attackers to brute force 6-digit verification codes due to a lack of rate limiting or invalidation.Course-tencent-cloud through version 2.0.1 is affected by a critical design flaw involving the improper restriction of authentication attempts. The application generates 6-digit verification codes sent via SMS or email for account recovery and login verification processes. Due to the absence of rate limiting, attempt counters, or code invalidation mechanisms, these codes remain valid for an indefinite period regardless of the number of failed attempts. An unauthenticated attacker who identifies a target's phone number or email address can initiate a verification request and systematically cycle through the 1,000,000 possible 6-digit combinations. By rotating source IP addresses to bypass basic volumetric blocking, attackers can successfully brute force the verification process and gain unauthorized access to victim accounts. This vulnerability significantly lowers the barrier for account takeover, as it requires no prior knowledge of credentials, only the target's associated communication identifier.

Impact

Successful exploitation of this vulnerability allows unauthorized access to user accounts. This facilitates data exfiltration, identity theft, and potential administrative takeover if the affected account holds privileged access. Given the nature of verification codes, this flaw is particularly dangerous for services where account takeover leads to unauthorized financial transactions or sensitive personal data exposure.

Recommendation

Prioritize the implementation of server-side rate limiting and account lockout policies for all authentication and verification endpoints. Ensure that verification codes are invalidated after a maximum number of failed attempts or a strict time-based window.

]]>highadvisoryauthentication-bypasscredential-stuffingweb-application-vulnerability