CVE-2026-78154: the-momentum open-wearables Public Invitation-Code Redemption Endpoint user_invitation_code.py redeem_invitation_code missing authentication
A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeeminvitationcode of the file backend/app/api/routes/v1/userinvitationcode.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing authentication. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects the-momentum/open-wearables versions up to and including 0.6.2, specifically the public invitation-code redemption endpoint implemented in backend/app/api/routes/v1/user_invitation_code.py.
Does exploitation require an account or user interaction?
No. The supplied severity vector indicates network access, low attack complexity, no privileges required, and no user interaction.
What does an attacker need to manipulate?
The reported vulnerable input is the code argument passed to redeem_invitation_code. Manipulating that argument can trigger the missing-authentication condition.
Is a fix available from the project?
No fix is identified in the provided data. The project was reportedly notified through an issue report but had not responded at the time of publication.