CVE-2026-78154
Received Received - Intake

Missing Authentication in the-momentum Open-Wearables

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description
A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/v1/user_invitation_code.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing authentication. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78154
EUVD
EUVD-2026-64673

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the-momentum open-wearables to 0.6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78154 is an authentication bypass vulnerability in the Open Wearables project. It affects the public invitation-code redemption endpoint, allowing unauthenticated attackers to exchange valid invitation codes for SDK access tokens and refresh tokens tied to a target user ID. The issue occurs because the endpoint does not require authentication, enabling unauthorized access to protected SDK functionality.

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to the endpoint /invitation-code/redeem without authentication headers. Check backend logs for requests with valid invitation codes but missing developer identity or secondary verification. Look for unusual token generation tied to arbitrary user IDs.

Impact Analysis

An attacker can exploit this vulnerability by sending a POST request with a valid invitation code to the redemption endpoint. They can then receive tokens and use them to access the victim’s SDK data, upload data, or maintain persistent sessions. This could lead to unauthorized access to health-data endpoints and session takeover.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive health data, which may violate GDPR and HIPAA compliance requirements. Unauthorized access to health data can result in data breaches, exposing personal and medical information, and failing to meet regulatory standards for data protection and patient privacy.

Mitigation Strategies

Immediately restrict access to the /invitation-code/redeem endpoint to authenticated users only. Implement server-side checks like expiration, revocation, rate limiting, and audit logging. Bind redemption to the intended recipient and avoid long-lived refresh tokens. Update to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78154. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart