Medium · published July 2, 2024
CVSS calls it medium at 5.3. It is confirmed in active exploitation. It sits in the 76.6th percentile for exploit probability.
⚠️ An unauthenticated API left phone number data exposed! Before the recent patch, Twilio Authy API allowed anyone to send requests and check if phone numbers were registered — yikes! 😱 Think of it like a public notice board where anyone can post requests about phone numbers and receive confirmation if they're on a guest list — but without any security checks in place! This oversight could have let an attacker compile a list of registered phone numbers, potentially leading to targeted phishing attacks or social engineering scams. While Authy accounts weren't compromised, the exposure of this information is still concerning for user privacy.
Think of it like a public notice board where anyone can post requests about phone numbers and receive confirmation if they're on a guest list — but without any security checks in place! The vulnerability in the Twilio Authy API allows for unauthenticated requests to check the registration status of phone numbers, exposing sensitive information without proper access controls.
This oversight could have let an attacker compile a list of registered phone numbers, potentially leading to targeted phishing attacks or social engineering scams. While Authy accounts weren't compromised, the exposure of this information is still concerning for user privacy. Update Authy for Android to version 25.1.0 or higher and for iOS to version 26.1.0 or higher. Additionally, conduct a review of API access settings to tighten security and prevent further data exposure. You've got this! By patching up and reviewing your settings, you’ll keep your users safe and sound! 🛡️