{"id":"CVE-2024-39891","kind":"vulnerability","aliases":["CVE-2024-39891"],"related":[],"title":"In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated…","description":"In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)","summary":"Twilio Authy has an API endpoint that needs no login and tells the caller whether a given phone number is registered with Authy. An attacker can use it to check phone numbers against the Authy user base, which is a privacy leak and aids phishing or targeting.","severity":"medium","cvss":5.3,"epss":null,"exploited":true,"exploited_at":"2024-07-23T00:00:00+00:00","products":[{"name":"twilio authy","fixed":["26.1.0"],"affected":"< 26.1.0","ecosystem":"vendor"},{"name":"twilio authy authenticator","fixed":["25.1.0"],"affected":"< 25.1.0","ecosystem":"vendor"},{"name":"Twilio Authy","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["authy-users","exploited","twilio-authy","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply mitigations per vendor instructions, or discontinue use of Authy if mitigations are unavailable (per CISA required action).","status":"open","published_at":"2024-07-02T18:15:03+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:31+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:58:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply mitigations per vendor instructions, or discontinue use of Authy if mitigations are unavailable (per CISA required action).","reach":"internet","impact":"low","summary":"Twilio Authy has an API endpoint that needs no login and tells the caller whether a given phone number is registered with Authy. An attacker can use it to check phone numbers against the Authy user base, which is a privacy leak and aids phishing or targeting.","category":"vendor","who_cares":["twilio-authy","authy-users"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker learns which phone numbers are registered with Authy","analyst_note":"Confirm the vendor's mitigation steps and whether the endpoint is patched; check the Twilio security notice for Authy and the CISA KEV entry for due date.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000458,"input_tokens":2823,"output_tokens":351,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':20A,23A '-39891':21A,24A '2024':121C '25.1.0':11A,97C '26.1.0':16A,102C 'accept':125C 'access':6A,92C,107C 'account':147C 'aid':83B 'android':9A,95C 'api':5A,44B,91C 'attack':64B 'authenticator':29A 'authi':4A,8A,13A,33B,38B,41B,62B,74B,90C,94C,99C,145C,146C 'authy':26A,28A,31A 'authy-us':32B 'base':76B 'caller':53B 'certain':109C 'check':69B 'compromis':150C 'contain':130C 'cve':19A,22A 'data':113C 'endpoint':45B,105C,124C 'exploit':35B,115C 'given':56B 'howev':151C 'inform':136C 'io':14A,100C 'june':120C 'leak':81B 'login':49B 'need':47B 'number':58B,71B,112C,132C,141C 'phish':84B 'phone':57B,70B,111C,131C,140C 'phone-numb':110C 'privaci':80B 'provid':106C 'regist':60B,143C 'request':129C 'respond':134C 'specif':122C 'stream':127C 'target':86B 'tell':51B 'twilio':3A,25A,27A,30A,37B,40B,89C 'twilio-authi':36B 'unauthent':18A,104C 'use':66B 'user':34B,75B 'vendor':39B 'whether':54B,138C 'wild':118C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-07-02T18:15:03+00:00","kev":{"dateAdded":"2024-07-23","dueDate":"2024-08-13","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-39891","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-39891","severity":null,"published_at":"2024-07-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-39891","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39891","severity":null,"published_at":"2024-07-02T18:15:03+00:00","modified_at":"2026-06-17T07:42:58+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}