ZeroDay Findings
Sign inSign up

Findings

CVE-2024-39891

Twilio Authy Information Disclosure Vulnerability

Published Jul 2, 2024 · updated Jun 17, 2026 · twilio authy

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)

Timeline

Detection, updates, and resolution for this record.

  1. Jul 2, 2024 · Catalog

    Detected

    In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were

  2. Jul 23, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Aug 13, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Aug 13, 2024

Affected

  • cpe twilio/authyversion unspecified
  • cpe twilio/authy authenticatorversion unspecified
  • vendor Twilio Authyversion unspecified

Sources

  • CISA KEVCVE-2024-39891

    Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.

    cisa.gov
  • CVE.orgCVE-2024-39891

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-39891

    30-day exploitation probability 1.7%

    first.org
  • NIST NVDCVE-2024-39891

    In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone

    nvd.nist.gov

References

CVE-2024-39891 · ZeroDay Findings