CVE-2024-39891: Twilio Authy Information Disclosure Vulnerability

CVE-2024-39891 is an information disclosure vulnerability in Twilio Authy. An unauthenticated API endpoint accepts a phone number in a request and returns whether that number is registered with Authy. This matters because the response reveals account existence without authentication, enabling enumeration of registered users that can support targeted follow-on attacks such as social engineering or account takeover attempts against multi-factor authentication users.

CISA notes the issue under CWE-203 and directs organizations to apply mitigations per vendor instructions or discontinue use if mitigations are unavailable. Confirm all product-specific details against the official Twilio Authy advisory.

How it works

The weakness is an observable discrepancy (CWE-203). The Authy API exposes an unauthenticated endpoint that processes a supplied phone number and returns registration status information. An attacker who can reach the endpoint simply submits phone numbers of interest and observes the responses to learn which numbers are associated with Authy accounts. No authentication or prior knowledge of the account is required. Because the difference in responses is directly observable, bulk probing becomes feasible. Exact request formats, response fields, and any rate-limiting behavior must be confirmed against the vendor advisory; do not assume additional mechanics beyond the documented information disclosure.

Am I affected? How to find it in your systems

Twilio Authy is commonly used as a multi-factor authentication service for end-user accounts, often integrated via mobile apps, SDKs, or backend API calls that verify or manage authenticators. Inventory any systems that rely on Authy for MFA, including identity providers, custom applications, and third-party services that call Authy APIs. Check configuration and code for direct use of Authy endpoints that accept phone numbers. Because specific affected versions are not listed here, compare your deployed Authy components and API usage against the vendor advisory.

• Search application inventories, package manifests, and API gateway configurations for Authy references.
• Review network traffic or API logs for requests containing phone numbers directed at Authy endpoints, especially unauthenticated ones.
• Look for telemetry showing repeated queries for many distinct phone numbers from the same source, which may indicate enumeration.
• Confirm with Twilio documentation whether your integration path is impacted and whether any configuration flags control the behavior.

How to remediate

Prioritize the vendor-supplied update or mitigation instructions for Twilio Authy. Apply them promptly across all instances and integrations. If the advisory indicates that mitigations are unavailable, discontinue use of the affected product or feature as directed by CISA. After patching, re-test the endpoint to verify that unauthenticated registration-status queries no longer succeed. For this class of information disclosure, also harden remaining APIs by requiring authentication where possible, enforcing strict rate limits, and ensuring error responses do not leak account existence.

If you can't patch immediately

Reduce exposure until the vendor fix can be applied. Segment Authy-related traffic so that only necessary internal systems can reach the API. Deploy virtual patching or WAF rules that block or heavily rate-limit unauthenticated requests containing phone numbers to Authy endpoints. If the registration-check functionality is not required for your workflows, disable or remove it. Increase monitoring for high-volume phone-number queries and alert on anomalous patterns. These controls do not eliminate the vulnerability but shrink the attack surface while you complete remediation. Confirm any temporary workarounds against the vendor advisory.

If your data may have been exposed

Actively exploited information-disclosure flaws can contribute to broader account compromise even when ransomware use is not documented for this CVE. Review Authy-related logs for evidence of mass enumeration, force credential and MFA resets for any accounts whose phone numbers may have been probed, and monitor for subsequent suspicious authentication activity. Organizations and individuals can also run a free exposure scan of their email addresses against known breach data sets to determine whether related credentials have already appeared in public dumps.