CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2024-07-02
Twilio Authy API Information Disclosure and Phone Number Enumeration Vulnerability (CVE-2024-39891) Analysis & Mitigation Guide
[Affected Scope] Twilio Authy API endpoints accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0
[Impact] Unauthenticated attackers can verify whether specific phone numbers are registered with Authy, enabling large-scale enumeration and targeted phishing/social engineering attacks
[Mitigation] Immediately update mobile applications to the latest versions (Android 25.1.0+ / iOS 26.1.0+) and enforce strict rate limiting on API gateways