Descripción
Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.
Acción recomendada
Aplicar las mitigaciones del fabricante; si no están disponibles, discontinuar el uso del producto.
Referencias
- Aviso de twilio.com twilio.com/en-us/changelog/Security_Alert_Authy_App_Android_iOS
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2024-39891