Twilio Authy API Information Disclosure and Phone Number Enumeration Vulnerability (CVE-2024-39891) Analysis & Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTTwilio Authy API endpoints accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0
Unauthenticated attackers can verify whether specific phone numbers are registered with Authy, enabling large-scale enumeration and targeted phishing/social engineering attacks
Immediately update mobile applications to the latest versions (Android 25.1.0+ / iOS 26.1.0+) and enforce strict rate limiting on API gateways
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Users must update their Authy mobile applications to the latest secure versions via official app stores. For enterprise environments, enforce the update policy using MDM solutions.
# Verify the installed Authy package version on Android devices via ADB
adb shell dumpsys package com.authy.authy | grep versionName
# Ensure the version is 25.1.0 or higher for Android, and 26.1.0 or higher for iOS2. Temporary Workaround & Hardening Configuration
If immediate client-side updates are not fully deployed, implement rate limiting and request validation at the API Gateway or Reverse Proxy level to mitigate automated enumeration attacks.
# Nginx configuration snippet to rate-limit unauthenticated API requests
limit_req_zone $binary_remote_addr zone=authy_rate_limit:10m rate=5r/s;
server {
listen 443 ssl;
server_name api.authy.com;
location /v1/api/verify/phone {
limit_req zone=authy_rate_limit burst=10 nodelay;
limit_req_status 429;
proxy_pass http://authy_backend;
}
}3. Log Audit & IoC Verification Commands
Analyze web server access logs to identify potential enumeration attempts characterized by high-frequency requests to the verification endpoint from single IP addresses.
# Identify top IP addresses making requests to the phone verification endpoint
grep '/v1/api/verify/phone' /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -nr | head -n 50Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-39891) is an information disclosure flaw in the Twilio Authy API due to an unauthenticated endpoint. The endpoint was designed to verify registration status but failed to require proper authentication, leading to an observable discrepancy in responses (CWE-203). By accepting a stream of requests containing phone numbers, the API disclosed whether each number was registered with the Authy service.
2. Exploitation Mechanics & Attack Scenario
Attackers targeted the exposed, unauthenticated endpoint by sending automated streams of requests containing large lists of phone numbers. Because the API responded with binary-like confirmation of registration status, attackers could systematically map out which phone numbers belonged to active Authy users. This vulnerability was actively exploited in the wild in June 2024 to harvest millions of registered phone numbers.
3. Infrastructure & Business Impact
Although Authy accounts and MFA tokens were not directly compromised, the exposure of registered phone numbers poses a significant security risk. Attackers can leverage this verified database to launch highly targeted SMS phishing (smishing) and social engineering campaigns, impersonating Authy or technical support to compromise downstream corporate and personal accounts.
Official Vendor Advisories & References
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)
Frequently Asked SecOps Questions (CVE-2024-39891)
FAQQ1. How critical is CVE-2024-39891 and is it actively exploited in the wild?
CVE-2024-39891 is rated CVSS 5.3 (MEDIUM) with a 30-day EPSS exploitation probability of 1.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-39891?
Primary impacted vendors include twilio across authy. Scope summary: Twilio Authy API accessed by Authy Android versions prior to 25.1.0 and Authy iOS versions prior to 26.1.0
Q3. What temporary mitigations or workarounds exist for CVE-2024-39891 before patching?
[Mitigation] Immediately update mobile applications to the latest versions (Android 25.1.0+ / iOS 26.1.0+) and enforce strict rate limiting on API gateways Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-39891
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (twilio)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.