CVE-2024-39891 kev in the critical feed json
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access t…
published 2y ago modified 4mo ago also EUVD-2024-38291
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Exploited
- added 2024-07-23
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)
Patch / fix
cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- twilio authy_2-factor_authentication 25.1.0, 26.1.0
Is CVE-2024-39891 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- Published
- Added to CISA KEV
- CISA SSVC: exploitation active
- CISA patch deadline
Known exploited
- Added
- 2y ago
- Patch by
- 2024-08-13 (2y ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Twilio, Authy
- CISA name
- Twilio Authy Information Disclosure Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
1.67% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected products
- twilio authy_2-factor_authentication
Classification
- Weakness
-
- CWE-203 Observable Discrepancy
References
-
cwe.mitre.org
/data/definitions/203.html
technical-description
-
twilio.com
/docs/usage/security/reporting-vulnerabilities
product
-
twilio.com
/en-us/changelog
release-notes
-
bleepingcomputer.com
/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers/
press/media-coverage
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-39891
government-resource, us-government-resource
Sources
- CVE List CVE-2024-39891
- NVD CVE-2024-39891
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.