{"id":"CVE-2024-39891","aliases":["EUVD-2024-38291","GHSA-vg5j-h7r8-88x8"],"status":"published","title":"In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an...","description":"In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01669,"percentile":0.77116,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-203"],"published":"2024-07-02T00:00:00Z","modified":"2026-06-17T07:42:58Z","kev":{"date_added":"2024-07-23","due_date":"2024-08-13","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-07-23"},{"source":"kev","since":"2024-07-23"}],"products":[{"vendor":"twilio","product":"authy"},{"vendor":"twilio","product":"authy_2-factor_authentication"},{"vendor":"twilio","product":"authy_authenticator"}],"references":[{"url":"https://cwe.mitre.org/data/definitions/203.html","tags":["x_transferred","Technical Description"]},{"url":"https://www.twilio.com/docs/usage/security/reporting-vulnerabilities","tags":["x_transferred","Product"]},{"url":"https://www.twilio.com/en-us/changelog","tags":["x_transferred","Release Notes"]},{"url":"https://www.bleepingcomputer.com/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers/","tags":["x_transferred","Press/Media Coverage"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-39891","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39891"},{"url":"https://www.bleepingcomputer.com/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers"},{"url":"https://github.com/advisories/GHSA-vg5j-h7r8-88x8"}],"sources":{"cve":[{"id":"CVE-2024-39891","description":"In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)","status":"published","published":"2024-07-02T00:00:00Z","modified":"2025-10-21T22:55:50.24Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N","level":"medium","assessor":"cna"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:34:19.28149Z"}],"euvd":[{"id":"EUVD-2024-38291","description":"In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)","status":"published","published":"2024-07-02T00:00:00Z","modified":"2025-10-21T22:55:50Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N","level":"medium"}],"exploited_since":"2024-07-23","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-vg5j-h7r8-88x8","title":"In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an...","description":"In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data. (Authy accounts were not compromised, however.)","status":"published","published":"2024-07-02T21:32:15Z","modified":"2025-10-22T00:34:10Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T15:04:08.734574Z"}],"kev":[{"id":"CVE-2024-39891","title":"Twilio Authy Information Disclosure Vulnerability","description":"Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.","cwes":["CWE-203"],"kev":{"date_added":"2024-07-23","due_date":"2024-08-13","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2024-39891","description":"In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)","status":"published","published":"2024-07-02T18:15:03.447Z","modified":"2026-06-17T07:42:58.63Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:10:10.545705Z"}]}}