Course Tencent Cloud
Monthly
Unauthenticated attackers can take over accounts on Course Tencent Cloud versions 2.0.1 and earlier by brute-forcing 6-digit SMS/email verification codes that are never invalidated or attempt-limited. Exploitation requires knowledge of the victim's registered phone number or email address and rotation of source IPs to bypass per-IP rate limiting, as the codes have no per-account attempt counter. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers can take over accounts on Course Tencent Cloud versions 2.0.1 and earlier by brute-forcing 6-digit SMS/email verification codes that are never invalidated or attempt-limited. Exploitation requires knowledge of the victim's registered phone number or email address and rotation of source IPs to bypass per-IP rate limiting, as the codes have no per-account attempt counter. No public exploit code or active exploitation has been identified at time of analysis.