CVE-2024-39891

unknown KEV

Published 2024-07-23 · Modified 2024-07-23

CVSS v3

—

CVSS v2

—

VIR risk

1.5

Description

Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.

CISA KEV

Vendor: Twilio
Product: Authy
Due date: 2024-08-13

Predictions

Exploit likelihood

99%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cisa-kev — https://www.twilio.com/en-us/changelog/Security_Alert_Authy_App_Android_iOS; https://nvd.nist.gov/vuln/detail/CVE-2024-39891

Exploits

References

https://www.twilio.com/en-us/changelog/Security_Alert_Authy_App_Android_iOS; https://nvd.nist.gov/vuln/detail/CVE-2024-39891

Verify integrity in audit chain (admin only). AS-IS.