CVE-2024-39891

Summary

CVE-2024-39891 is a vulnerability affecting the Twilio Authy API, exploited in June 2024. The unauthenticated endpoint, accessible in Authy Android before 25.1.0 and Authy iOS before 26.1.0, allowed attackers to access phone number registration information. This issue did not compromise Authy accounts directly, but instead granted the ability to determine if certain phone numbers were linked to the service. A stream of requests containing phone numbers was all that was required to receive the corresponding registration data from the vulnerable endpoint.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.