CVE-2024-39891

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

https://www.twilio.com/en-us/changelog/Security_Alert_Authy_App_Android_iOS; https://nvd.nist.gov/vuln/detail/CVE-2024-39891

Remediation deadline: August 13, 2024

Description

Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.

Timeline

Published:July 23rd, 2024 12:00 AM

Last modified:July 23rd, 2024 12:00 AM

Added to KEV:July 23rd, 2024

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

Twilio

Products

Authy

Weaknesses (CWE)

CWE-203

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute