CVE-2024-39891
Published: July 23, 2024
Official Description
Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.
CISA KEV Advisory
Twilio Authy Information Disclosure Vulnerability
Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Risk Analysis
This information disclosure vulnerability in Twilio Authy's API allows an unauthenticated attacker to determine if a phone number is registered with Authy. The high severity, confirmed in-the-wild exploitation, and an EPSS score of 0.29582 indicate that this flaw is actively being used to gather sensitive information.
This vulnerability is actively exploited in the wild and is present in CISA's KEV catalog. The flaw is remotely exploitable without authentication.
Twilio Authy users should ensure their applications are updated to versions that address this API information disclosure. Implement robust API security practices and monitor for unusual access patterns.
Technical Analysis
CVE-2024-39891 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2024-39891 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2024-39891 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1