736
Authy got hacked, and 33 million user phone numbers were stolen
(appleinsider.com)
This is a most excellent place for technology news and articles.
Exploiting is hacking, quit being pedantic.
A system fault is not the same as a vulnerability. These would have different baseline CVSS 3.1 scores, with the temporal and environmental reducing over time. A medium/low at best for a public endpoint exposing PII.