the-momentum open-wearables up to 0.6.2 Public Invitation-Code Redemption Endpoint user_invitation_code.py redeem_invitation_code missing authentication 🚫 [False Positive]

Noticeinfo

⚠️ It seems this issue is a false-positive. Please confirm the sources provided and consider disregarding this entry. The endpoint is public on purpose and the invitation code is the credential. This is the standalone SDK onboarding path for mobile apps that have no backend of their own: a developer generates a code via the authenticated dashboard endpoint, the user types it into the app, and it's redeemed for SDK-scoped tokens.

Productinfo

Vendor

• the-momentum

Name

• open-wearables

Version

• 0.6.0
• 0.6.1
• 0.6.2

Website

• Product: https://github.com/the-momentum/open-wearables/

Timelineinfo

08/23/2026 Advisory disclosed
08/23/2026 +0 days VulDB entry created
08/25/2026 +2 days VulDB entry last update

Sourcesinfo

Product: github.com

Advisory: github.com
False Positive: Yes
Disputed: 🔍

CVE: CVE-2026-78154 (🔒)
GCVE (CVE): GCVE-0-2026-78154
GCVE (VulDB): GCVE-100-394536

Entryinfo

Created: 08/23/2026 09:47
Updated: 08/25/2026 10:30
Changes: 08/23/2026 09:47 (55), 08/24/2026 11:19 (30), 08/25/2026 10:30 (3)
Complete: 🔍
Submitter: Aston
Cache ID: 216::103

Submitinfo

Accepted

• Submit #882887: self-hosted the-momentum/open-wearables main v (by Aston)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion

Do you know our Splunk app?

Download it now for free!