Withdrawn: this CVE is not a vulnerability
The assigning CNA withdrew CVE-2026-78154 on 25 August 2026, and it carries the Rejected state at CVE.org and NVD. It must not be treated as a live finding. Its pre-withdrawal severity, score and exploitability are withheld below; the record itself is kept because withdrawals are reversible and because the reject reason is the correction worth publishing.
CVE-2026-78154
the-momentum open-wearables Public Invitation-Code Redemption Endpoint user_invitation_code.py redeem_invitation_code missing authentication
Description
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The endpoint is public on purpose and the invitation code is the credential. This is the standalone SDK onboarding path for mobile apps that have no backend of their own: a developer generates a code via the authenticated dashboard endpoint, the user types it into the app, and it's redeemed for SDK-scoped tokens.
INFO
Published Date :
Aug. 24, 2026, 12:16 a.m.
Last Modified :
Aug. 25, 2026, 9:17 a.m.
Remotely Exploit :
—
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 2.0 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-78154 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-78154 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by [email protected]
Aug. 25, 2026
Action Type Old Value New Value -
CVE Modified by [email protected]
Aug. 25, 2026
Action Type Old Value New Value Changed Description A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/v1/user_invitation_code.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing authentication. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet. Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The endpoint is public on purpose and the invitation code is the credential. This is the standalone SDK onboarding path for mobile apps that have no backend of their own: a developer generates a code via the authenticated dashboard endpoint, the user types it into the app, and it's redeemed for SDK-scoped tokens. Removed CVSS V4.0 VulDB: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Removed CVSS V3.1 VulDB: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Removed CVSS V2 VulDB: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Removed CWE VulDB: CWE-287 Removed CWE VulDB: CWE-306 Removed Reference VulDB: https://github.com/the-momentum/open-wearables/ Removed Reference VulDB: https://github.com/the-momentum/open-wearables/issues/1274 Removed Reference VulDB: https://vuldb.com/cve/CVE-2026-78154 Removed Reference VulDB: https://vuldb.com/submit/882887 Removed Reference VulDB: https://vuldb.com/vuln/394536 Removed Reference VulDB: https://vuldb.com/vuln/394536/cti Removed Affected [{'cpes': ['cpe:2.3:a:the-momentum:open-wearables:*:*:*:*:*:*:*:*'], 'vendor': 'the-momentum', 'modules': ['Public Invitation-Code Redemption Endpoint'], 'product': 'open-wearables', 'versions': [{'status': 'affected', 'version': '0.6.0'}, {'status': 'affected', 'version': '0.6.1'}, {'status': 'affected', 'version': '0.6.2'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 24, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-78154', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-24T17:47:50.689224Z'} -
New CVE Received by [email protected]
Aug. 24, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:the-momentum:open-wearables:*:*:*:*:*:*:*:*'], 'vendor': 'the-momentum', 'modules': ['Public Invitation-Code Redemption Endpoint'], 'product': 'open-wearables', 'versions': [{'status': 'affected', 'version': '0.6.0'}, {'status': 'affected', 'version': '0.6.1'}, {'status': 'affected', 'version': '0.6.2'}]}] Added Description A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/v1/user_invitation_code.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing authentication. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Added CVSS V2 (AV:N/AC:L/Au:N/C:P/I:P/A:P) Added CWE CWE-287 Added CWE CWE-306 Added Reference https://github.com/the-momentum/open-wearables/ Added Reference https://github.com/the-momentum/open-wearables/issues/1274 Added Reference https://vuldb.com/cve/CVE-2026-78154 Added Reference https://vuldb.com/submit/882887 Added Reference https://vuldb.com/vuln/394536 Added Reference https://vuldb.com/vuln/394536/cti