CVE-2024-39891: Twilio Authy Information Disclosure Flaw

CVE-2024-39891 Overview

CVE-2024-39891 is an information disclosure vulnerability in the Twilio Authy API that allows unauthenticated attackers to enumerate phone numbers registered with the Authy two-factor authentication service. The vulnerability was actively exploited in the wild in June 2024, enabling threat actors to verify millions of Authy MFA phone numbers through an unsecured API endpoint.

Critical Impact

This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog and was confirmed to be exploited in the wild. Attackers could enumerate registered phone numbers, potentially enabling targeted phishing, SIM swapping, or social engineering attacks against users relying on Authy for multi-factor authentication.

Affected Products

• Twilio Authy Android before version 25.1.0
• Twilio Authy iOS before version 26.1.0
• Twilio Authy Authenticator mobile applications

Discovery Timeline

• 2024-07-02 - CVE-2024-39891 published to NVD
• 2025-11-05 - Last updated in NVD database

Technical Details for CVE-2024-39891

Vulnerability Analysis

This vulnerability is classified as CWE-203: Observable Discrepancy (Information Exposure Through Discrepancy). The flaw exists in an unauthenticated API endpoint within the Twilio Authy infrastructure that accepted bulk requests containing phone numbers and responded with information indicating whether each phone number was registered with the Authy service.

The vulnerability allows attackers to perform large-scale enumeration attacks without authentication, effectively creating a phone number oracle. While Authy user accounts themselves were not directly compromised, the exposed registration status data presents significant privacy and security concerns.

Root Cause

The root cause is an improperly secured API endpoint that failed to implement authentication controls and rate limiting. The endpoint was designed to check phone number registration status but lacked adequate access controls, allowing anyone to query the service. This represents a classic information disclosure vulnerability where the API response behavior differs based on whether a phone number is registered, creating an observable discrepancy that attackers can exploit.

Attack Vector

The attack is conducted over the network without requiring authentication or user interaction. Attackers can send a stream of HTTP requests to the vulnerable endpoint, each containing phone numbers to verify. The API responds with registration status information, allowing attackers to build a database of valid Authy-registered phone numbers.

The exploitation mechanism involves:

1. Identifying the vulnerable API endpoint in the Authy backend
2. Crafting requests with target phone numbers
3. Analyzing responses to determine registration status
4. Automating the process to enumerate millions of phone numbers

Attackers exploited this vulnerability in June 2024 to verify millions of phone numbers, with the resulting data potentially used for targeted attacks such as SIM swapping, phishing campaigns, or social engineering attacks against high-value targets known to use Authy MFA.

Detection Methods for CVE-2024-39891

Indicators of Compromise

• Unusual spikes in API requests to Authy phone number verification endpoints
• Large volumes of phone number enumeration attempts from single IP addresses or IP ranges
• Automated or scripted access patterns querying sequential or targeted phone number lists
• Logs showing high-frequency requests with minimal time between calls to registration check endpoints

Detection Strategies

• Monitor API gateway logs for anomalous request patterns to phone number verification endpoints
• Implement behavioral analysis to detect enumeration attacks with high request volumes
• Deploy rate limiting alerts to identify potential abuse before significant data exposure
• Cross-reference known threat actor IP addresses with API access logs
• Review authentication logs for patterns consistent with automated enumeration tools

Monitoring Recommendations

• Enable detailed logging on all API endpoints handling phone number data
• Configure SIEM alerts for bulk request patterns indicative of enumeration attacks
• Monitor for reports of Authy-related phishing or SIM swapping attempts targeting your organization's users
• Track CISA KEV catalog updates and threat intelligence feeds for related exploitation activity

How to Mitigate CVE-2024-39891

Immediate Actions Required

• Update Authy Android to version 25.1.0 or later immediately
• Update Authy iOS to version 26.1.0 or later immediately
• Audit API endpoint configurations for proper authentication requirements
• Review and strengthen rate limiting on all user enumeration-sensitive endpoints
• Alert users who may have been affected about potential phishing and SIM swapping risks

Patch Information

Twilio has released patched versions of the Authy mobile applications that address this vulnerability. Users should update to Authy Android version 25.1.0 or later and Authy iOS version 26.1.0 or later. The patches secure the vulnerable API endpoint by implementing proper authentication and access controls. For the latest security updates and patch information, refer to the Twilio Changelog.

Organizations using Authy for enterprise MFA should verify all deployed applications are updated and consider implementing additional security monitoring for affected users. For vulnerability reporting procedures, see the Twilio Vulnerability Reporting Guide.

Workarounds

• Implement additional identity verification steps beyond phone-based MFA for high-risk accounts
• Consider migrating to hardware security keys or authenticator apps not dependent on phone number verification
• Enable SIM lock with your mobile carrier to protect against SIM swapping attacks
• Educate users about increased phishing risks and social engineering attempts targeting Authy users
• Monitor accounts for unauthorized access attempts following potential exposure

# Verify Authy app versions on managed devices
# For Android devices via ADB
adb shell dumpsys package com.authy.authy | grep versionName

# For iOS devices via MDM, verify app version is 26.1.0 or later
# Consult your MDM documentation for specific commands