CVE-2024-39891mediumunder attackCWE-203

CVE-2024-39891

Published · Updated

Follow this CVE+ Monitor Authy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 5.3epss 1.7%
from disclosure to weapon
Published on NVDJul 2
CISA KEV+21d
Action required by CISAfederal deadline: 2024-08-13

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Twilio's Authy app had a security weakness that let anyone check if a phone number was registered with Authy, without needing to log in. This exposed which phone numbers use Authy, though the actual accounts themselves weren't compromised.

Technical detail

An unauthenticated API endpoint in Authy Android (<25.1.0) and iOS (<26.1.0) allowed attackers to enumerate registered phone numbers by submitting requests containing phone numbers and receiving confirmation of registration status. This information disclosure vulnerability (CWE-203) was actively exploited in June 2024, enabling account enumeration attacks without requiring authentication.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)
CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N
Affected products
n/a · n/a