Course Tencent Cloud EUVD-2026-102966

Exploitation requires that the attacker already knows the victim's registered phone number or email address (the AT:P attack requirement) and that the target has an account on a course-tencent-cloud instance at version 2.0.1 or earlier. The specific enabling defect is that the 6-digit SMS/email verification code generated by the Verify service is never invalidated after use or failure and has no per-account attempt counter, exposed via the password-reset and verify-login endpoints. The practical limiting factors are: the attacker must brute-force up to one million code combinations, must rotate source IPs to bypass any per-IP rate limiting present, and must know a valid victim identifier - no authentication (PR:N) or user interaction (UI:N) on the victim's part is otherwise needed.

The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N) scores 9.1, driven by network reach (AV:N), no privileges (PR:N), no user interaction (UI:N) and high confidentiality/integrity impact from full account takeover. However, two metrics meaningfully temper real-world risk: AT:P means a specific attack requirement exists (the attacker must already know the victim's phone number or email to trigger and target a code), and AC:H reflects the non-trivial effort of brute-forcing a 6-digit space (up to 1,000,000 guesses) while rotating source IPs to evade per-IP throttling. No EPSS score was provided in the input, and there is no CISA KEV listing and no POC flag set - so exploitation probability cannot be quantified from the data given. A detailed third-party technical writeup (hackmd) and a VulnCheck advisory describe the flaw, but no weaponized exploit tool is indicated. Net: this is a genuinely serious authentication weakness (CWE-307) that yields account takeover, but the need to know the victim's identifier plus the brute-force effort make it better suited to targeted attacks than opportunistic mass exploitation, and the affected product is a niche open-source platform with limited deployment - so this is a high-severity-but-situational issue rather than a broad emergency. No conflicting signals between CVSS and description were found; both agree on a remote, unauthenticated, targeted vector.

An attacker who knows a target user's registered phone number or email requests a password-reset or login verification code, then submits automated guesses against the verify endpoint; because the 6-digit code is never invalidated and attempts are not rate-limited, the attacker rotates source IPs to defeat any per-IP blocking and eventually guesses the valid code, resetting the password and taking over the account. No working exploit tool is confirmed in the input, though a public technical writeup documents the brute-force method. The network, no-privilege, no-interaction profile (AV:N/PR:N/UI:N) makes this remotely achievable, bounded mainly by the brute-force effort (AC:H) and the requirement to know the victim's identifier (AT:P).