CVE-2024-39891
Twilio Authy Information Disclosure Vulnerability
Description
CVE-2024-39891 is a medium-severity information disclosure vulnerability in the Twilio Authy API that allowed unauthenticated attackers to verify whether phone numbers were registered with the Authy multi-factor authentication service. Affecting Authy Android before version 25.1.0 and Authy iOS before version 26.1.0, this vulnerability was actively exploited in June 2024 to enumerate millions of phone numbers. With a CVSS v3.1 base score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), it has been listed in CISA's KEV catalog with a remediation deadline of August 13, 2024. The EPSS score of 0.29582 (96.5th percentile) indicates significant exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| twilio | authy | < 26.1.0 |
| twilio | authy authenticator | < 25.1.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://cwe.mitre.org/data/definitions/203.html(Technical Description)
- https://www.bleepingcomputer.com/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers/(Press/Media Coverage)
- https://www.twilio.com/docs/usage/security/reporting-vulnerabilities(Product)
- https://www.twilio.com/en-us/changelog(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-39891(US Government Resource)
Weakness Type
CWE-203: Observable Discrepancy
CVE-2024-39891 is classified under CWE-203, which describes situations where a product behaves differently or returns distinct responses based on whether a particular condition is true or false, thereby revealing information that should remain confidential. In the context of Twilio Authy, an unauthenticated API endpoint responded differently depending on whether a queried phone number was registered with the Authy service. By observing these response discrepancies, attackers could systematically determine which phone numbers were associated with Authy accounts, enabling targeted attacks against users of multi-factor authentication. Learn more about CWE-203
Impact Analysis
Mass Phone Number Enumeration is the primary impact of CVE-2024-39891. The vulnerability allowed attackers to query the Authy API with phone numbers and determine which ones had registered Authy accounts, effectively creating a database linking phone numbers to Authy MFA usage.
Confidentiality Impact is low but significant in aggregate (C:L). While individual data points (whether a phone number uses Authy) may seem minor, the ability to enumerate millions of records creates substantial intelligence value. Attackers compiled lists of phone numbers with confirmed Authy registration, which reveals that those users employ MFA and identifies potential targets for SIM swapping, social engineering, or phishing attacks specifically designed to bypass Authy-based authentication.
Integrity Impact is none (I:N). The vulnerability only allowed reading information; no data modification was possible through the affected endpoint.
Availability Impact is none (A:N). The API endpoint continued functioning normally despite exploitation, though the high volume of enumeration requests could have affected service performance.
Real-World Exploitation Impact: The exploitation in June 2024 was extensive. Threat actors compiled databases of phone numbers linked to Authy accounts, and this data has significant value in the cybercriminal ecosystem. Knowing that a specific phone number uses Authy helps attackers plan targeted attacks against those individuals' accounts on services protected by Authy MFA. The EPSS score of 0.29582 (96.5th percentile) and CISA's KEV listing confirm the significance of the exploitation. CISA lists the ransomware association as "Unknown."
Exploit Maturity
CVE-2024-39891 was actively exploited in the wild during June 2024, as confirmed by its listing in CISA's KEV catalog with a remediation deadline of August 13, 2024. The EPSS score of 0.29582 (96.5th percentile) reflects significant exploitation activity.
Mass Enumeration Campaign: BleepingComputer reported on the large-scale abuse of this API vulnerability to verify millions of Authy MFA phone numbers. Threat actors submitted streams of phone numbers to the unauthenticated endpoint and compiled databases of confirmed Authy users based on the API responses.
Low Exploitation Complexity: The attack required no sophisticated tools or techniques. An attacker only needed to send HTTP requests to the affected API endpoint with phone numbers as input. The API's different responses for registered versus unregistered numbers made enumeration trivial to automate at massive scale.
Data in Criminal Markets: The compiled phone number databases have value in underground markets, enabling targeted SIM-swapping attacks, spear phishing campaigns, and social engineering attacks against users known to employ Authy MFA. This secondary exploitation potential extends the vulnerability's impact well beyond the initial enumeration.
Ransomware Association: CISA lists the ransomware status as "Unknown." While the vulnerability itself does not enable direct system compromise, the intelligence gained through enumeration supports more targeted attacks that could lead to account takeovers and subsequent ransomware deployment.
Remediation
-
Update Authy mobile applications immediately to version 25.1.0 or later for Android and version 26.1.0 or later for iOS. These updated versions address the API vulnerability that allowed phone number enumeration. Check application version numbers on all devices using Authy and update through the respective app stores.
-
Assess exposure from the enumeration campaign by assuming that phone numbers associated with Authy accounts may have been compromised. Users who had Authy accounts prior to the patch should be considered potentially enumerated. This does not mean their MFA is compromised, but their phone numbers are now known to be associated with Authy-protected accounts.
-
Enable additional security measures on Authy accounts including setting a backup password if not already configured, enabling the multi-device feature only when needed and disabling it afterward, and reviewing linked accounts for any unauthorized additions. Monitor for suspicious SIM swap attempts by watching for unexpected loss of cellular service.
-
Warn users about increased phishing risk particularly for social engineering attacks targeting MFA. Attackers who know a phone number uses Authy may craft targeted phishing messages impersonating Authy or Twilio, requesting users to approve fraudulent authentication requests or reveal backup codes. Educate users that Twilio will never request MFA codes via unsolicited communications.
-
Monitor for SIM-swapping indicators as enumerated phone numbers become targets for SIM swap attacks designed to intercept SMS-based authentication. Consider migrating high-value accounts from phone-based MFA to hardware security keys (FIDO2/WebAuthn) or authenticator apps that do not rely on phone numbers for account enumeration resistance.
Technical Details
CVE-2024-39891 is an information disclosure vulnerability in the Twilio Authy API that enabled unauthenticated phone number enumeration through observable response discrepancies.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N produces a base score of 5.3. The network attack vector (AV:N) confirms remote exploitability. Low attack complexity (AC:L) reflects the simplicity of querying the API. No privileges (PR:N) or user interaction (UI:N) are needed. The scope is unchanged (S:U). Only confidentiality is impacted, and at a low level (C:L), because only the registration status of phone numbers is disclosed, not credentials or full account data.
Vulnerability Mechanism: The Twilio Authy API exposed an endpoint that accepted phone number queries without authentication. When a phone number was submitted, the API returned a response that differed based on whether that phone number was registered with Authy. This observable discrepancy (as described by CWE-203) allowed attackers to systematically determine which phone numbers in a given dataset were associated with Authy MFA accounts.
Enumeration at Scale: The unauthenticated nature of the endpoint and the absence of effective rate limiting allowed attackers to submit massive streams of phone numbers for verification. The binary response pattern (registered vs. not registered) made automated processing trivial. Attackers could test millions of phone numbers in relatively short timeframes, building comprehensive databases of Authy users.
Affected Products: The vulnerability impacted Authy Android before version 25.1.0 and Authy iOS before version 26.1.0 (also listed as Authy Authenticator). The fix involved API-level changes that prevent the endpoint from disclosing registration status to unauthenticated callers, coupled with client-side updates in the mobile applications.
Frequently Asked Questions
What is CVE-2024-39891?
CVE-2024-39891 is an information disclosure vulnerability in the Twilio Authy API that allowed unauthenticated attackers to determine whether specific phone numbers were registered with the Authy multi-factor authentication service. It was exploited in June 2024 to enumerate millions of phone numbers.
Does CVE-2024-39891 mean my Authy MFA is compromised?
No, the vulnerability does not compromise your MFA codes or accounts directly. It only revealed whether your phone number was registered with Authy. However, this information can be used to target you with SIM-swapping attacks, phishing attempts, or social engineering designed to bypass MFA. Update your Authy app and remain vigilant for suspicious activity.
What should Authy users do to protect themselves?
Update the Authy app to the latest version (Android 25.1.0+ or iOS 26.1.0+). Set a strong backup password, disable the multi-device feature when not in use, and be alert for phishing attempts impersonating Twilio or Authy. Consider using hardware security keys for high-value accounts as an additional protection layer.
How were millions of phone numbers enumerated?
Attackers sent automated streams of phone numbers to an unauthenticated Authy API endpoint. The API responded differently for registered versus unregistered numbers, allowing attackers to systematically verify which phone numbers had Authy accounts. The lack of authentication and insufficient rate limiting enabled mass enumeration at scale.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.