CVE-2026-78154 affects the-momentum open-wearables software up to version 0.6.2. The vulnerability is located in the redeem_invitation_code function within backend/app/api/routes/v1/user_invitation_code.py. Manipulating the 'code' argument bypasses authentication controls, allowing an attacker to remotely exploit the Public Invitation-Code Redemption Endpoint. The vulnerability corresponds to CWE-287 (Improper Authentication). The project has been informed but has not responded or issued a fix at the time of this report.

Successful exploitation can lead to missing authentication on the invitation code redemption endpoint, potentially allowing unauthorized users to redeem invitation codes remotely. This could result in unauthorized access or privilege escalation within the affected system. The CVSS v3.1 base score is 7.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. Until a fix is available, restrict access to the invitation code redemption endpoint if possible and apply compensating controls to limit exposure.