CVE-2024-39891: Twilio Authy Information Disclosure Vulnerability
What It Is — An unauthenticated API endpoint in Twilio Authy accepts a phone number and returns a Boolean indicating whether that number is registered with Authy. This reveals user enrollment status without requiring any credentials.
Exploitability — The endpoint is publicly reachable; researchers have published a proof‑of‑concept request. No public reports of active exploitation, but the flaw can be abused at scale. (CVSS ≈ 6.5 – moderate).
Affected Products — Twilio Authy (two‑factor authentication service) API.
Why It Matters for Trust & Control Assurance
- Continuous monitoring must verify that every API enforces authentication, otherwise a simple request can expose sensitive enrollment data.
- Demonstrable evidence that authentication controls are enforced is a core audit artifact for regulators and enterprise buyers.
- A breach of this type erodes confidence in third‑party MFA providers; showing remediation in a Trust Center builds a defensible control posture.
Recommended Actions
- Review Twilio’s advisory and apply any released patches or configuration updates.
- Block or restrict the vulnerable endpoint at your API gateway or firewall.
- Update internal API security policies to require authentication for all enrollment‑status checks.
- Capture remediation steps as evidence in your control‑mapping platform and integrate the finding into continuous control monitoring.
- Validate that the authentication control objective is satisfied across all relevant frameworks (e.g., NIST CSF 2.0, ISO 27001).
Source: CISA KEV – CVE‑2024‑39891