---
id: "CVE-2024-39891"
kind: "vulnerability"
aliases: ["CVE-2024-39891"]
title: "In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated\u2026"
severity: "medium"
cvss: 5.3
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "twilio authy", "fixed": ["26.1.0"], "affected": "< 26.1.0", "ecosystem": "vendor"}, {"name": "twilio authy authenticator", "fixed": ["25.1.0"], "affected": "< 25.1.0", "ecosystem": "vendor"}, {"name": "Twilio Authy", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["authy-users", "exploited", "twilio-authy", "vendor"]
not_affected_if: ["unknown"]
published_at: "2024-07-02T18:15:03+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-39891", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39891", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated…

Twilio Authy has an API endpoint that needs no login and tells the caller whether a given phone number is registered with Authy. An attacker can use it to check phone numbers against the Authy user base, which is a privacy leak and aids phishing or targeting.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:twilio authy affected < 26.1.0 fixed 26.1.0
- vendor:twilio authy authenticator affected < 25.1.0 fixed 25.1.0
- vendor:Twilio Authy affected ? fixed ?

## Fix

Apply mitigations per vendor instructions, or discontinue use of Authy if mitigations are unavailable (per CISA required action).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-39891
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-39891

## From the sources

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_