Twilio Authy Information Disclosure Vulnerability

Exploited in the wild. Listed by CISA on 2024-07-23; known to be used by ransomware.

1.7%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Nonecheck to confirm it

Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.

No ready check is stored for this CVE. Confirm it by hand from the references.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-39891

Use this check only on systems you are authorised to test. Where the data comes from