SECUFOCUSNOW
Home›CVE index›CVE-2024-39891
CISA KEV · Known exploitedMedium

CVE-2024-39891

Twilio Authy

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)

CVSS
5.3
EPSS
1.48%
71.3% percentile
CISA KEV
Listed
Published
2024.07.03
PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV
Exploit probability1.48%
Technical severityCVSS 5.3

Vulnerability overview

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)

Affected product and versions

Product
Twilio Authy
Affected versions
< 26.1.0, < 25.1.0
Fixed versions
26.1.0, 25.1.0

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Due date: 2024.08.13
  1. 1
    Identify

    Confirm that Twilio Authy and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
CWE-203
KEV added
2024.07.23
Ransomware use
미확인
CVE-2024-39891 — Twilio Authy | SECUFOCUS NOW