CVE-2024-39891
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Published Jul 2, 2024
Updated: Jul 24, 2024
CWE ID 203
Summary
CVE-2024-39891 is a vulnerability affecting the Twilio Authy API, exploited in June 2024. The unauthenticated endpoint, accessible in Authy Android before 25.1.0 and Authy iOS before 26.1.0, allowed attackers to access phone number registration information. This issue did not compromise Authy accounts directly, but instead granted the ability to determine if certain phone numbers were linked to the service. A stream of requests containing phone numbers was all that was required to receive the corresponding registration data from the vulnerable endpoint.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Share
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
Note: This is just a basic overview providing quick insights into CVE-2024-39891 information. Gain full access to comprehensive CVE data, third party vulnerabilities, compromised credentials and more with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions