{"id":"CVE-2024-39891","aliases":[],"url":"https://o3.security/vulnerability/CVE-2024-39891","summary":"In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited…","details":"In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)","published":"2024-07-02T00:00:00.000Z","modified":"2025-10-21T22:55:50.240Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N"},"epss":{"score":0.01669,"percentile":0.75596,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":2,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://cwe.mitre.org/data/definitions/203.html"},{"type":"WEB","url":"https://www.twilio.com/docs/usage/security/reporting-vulnerabilities"},{"type":"WEB","url":"https://www.twilio.com/en-us/changelog"},{"type":"WEB","url":"https://www.bleepingcomputer.com/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers/"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-39891"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2025-10-21T22:55:50.240Z"}}