CVE-2024-39891
Twilio Authy ≤ 26.1.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2024-39891 is a medium-severity Observable Discrepancy (CWE-203) vulnerability in Twilio Authy. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Discovery (T1087); ranked in the top 28% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to IA-6 (Authentication Feedback) and SI-11 (Error Handling) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability CVE-2024-39891 resides in the Twilio Authy API accessed by Authy Android before version 25.1.0 and Authy iOS before version 26.1.0. An unauthenticated endpoint exposed limited phone-number data by accepting requests that queried registration status, returning whether each supplied number was associated with an Authy account. The issue is classified under CWE-203 with a CVSS score of 5.3.
Unauthenticated remote attackers could exploit the endpoint by submitting streams of phone numbers in rapid succession and parsing the responses to determine registration status. This allowed enumeration of users relying on Authy for MFA without compromising account credentials or further access.
Public references, including Twilio's security reporting page and changelog, document the flaw alongside independent reporting that the endpoint was abused in the wild during June 2024 to verify millions of phone numbers.
The EPSS score rose from lower values to a peak of 0.2958 on 2026-02-07 before receding to the current 0.1707, indicating a clear post-disclosure increase in exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38291
Vulnerability Data
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of…
more
requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)
- CWE(s)
- KEV Date Added
- 23 July 2024
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Obscures authentication feedback so that success/failure differences are not observable to attackers.
Requires error messages to avoid revealing exploitable details, directly stopping observable response discrepancies.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent observable response discrepancies via consistent error handling and timing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Accurate, synchronized timestamps reduce observable timing discrepancies that an attacker could exploit to infer sensitive information or distinguish between success and failure paths.