Description
Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| authy_2-factor_authentication | twilio / authy_2-factor_authentication | >= 0, < 26.1.0 | affected |
| authy_2-factor_authentication | twilio / authy_2-factor_authentication | >= 0, < 25.1.0 | affected |
| authy_2-factor_authentication | twilio / authy_2-factor_authentication | >= 0, < 26.1.0 | affected |
| authy_2-factor_authentication | twilio / authy_2-factor_authentication | >= 0, < 25.1.0 | affected |
| n/a | n/a / n/a | n/a | affected |