CVE-2024-39891: Twilio Authy API phone number enumeration via observable discrepancy

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed in-the-wild exploitation and CISA KEV listing, though impact is limited to information disclosure with no account compromise.

What it is

An unauthenticated endpoint in the Twilio Authy API, reachable through Authy Android before 25.1.0 and Authy iOS before 26.1.0, accepted streams of phone numbers and returned whether each was registered with Authy. This is a CWE-203 observable discrepancy that leaks account registration status at scale, and it was exploited in the wild in June 2024. Authy accounts themselves were not compromised.

Impact

An attacker learns which phone numbers are enrolled in Authy, enabling targeted phishing, SIM-swap or MFA-bypass attempts against confirmed users. No account data or credentials are directly exposed.

Attack surface

Reachable over the network through the Authy API endpoint; the CVSS vector shows no privileges and no user interaction required. The endpoint is unauthenticated, so any client able to send requests can query it.

Exploitation

Listed in CISA KEV (added 2024-07-23) with confirmed in-the-wild exploitation in June 2024; EPSS 30-day probability is about 1.7 percent (75th percentile). No ransomware campaign use is documented.

What to do

• Upgrade Authy Android to 25.1.0 or later and Authy iOS to 26.1.0 or later, or follow Twilio's current changelog guidance if newer builds supersede these.
• If the affected endpoint cannot be patched immediately, restrict or block access to it per vendor instructions, or discontinue use of the product as CISA advises.
• Rate-limit and monitor API requests that submit batches of phone numbers to detect enumeration patterns.
• Treat Authy registration status as sensitive: warn users that confirmed enrollment can be used for targeted phishing and SIM-swap attempts.
• Review MFA posture for high-value accounts and prefer phishing-resistant factors where feasible.

Detection

• Monitor Authy API logs for high-volume or sequential phone-number queries from single sources or IP ranges.
• Alert on anomalous response patterns indicating registration-status probing, such as repeated 200 responses with minimal payload variation.
• Correlate spikes in Authy API enumeration traffic with downstream phishing or SIM-swap activity against the same numbers.
• Track client versions of Authy Android below 25.1.0 and Authy iOS below 26.1.0 still in use.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.