The vulnerability CVE-2026-78154 exists in the-momentum open-wearables versions 0.6.0, 0.6.1, and 0.6.2. It impacts the redeem_invitation_code function located in backend/app/api/routes/v1/user_invitation_code.py. The flaw is due to missing authentication checks when processing the 'code' argument at the public invitation-code redemption endpoint. This allows remote attackers to redeem invitation codes without authentication, potentially bypassing intended access controls. The project has been informed but has not issued a patch or mitigation guidance as of the publication date.

The vulnerability allows unauthenticated remote attackers to redeem invitation codes via the affected endpoint, potentially bypassing access controls or gaining unauthorized access to functionality tied to invitation codes. The CVSS 4.0 base score is 6.9 (medium), reflecting network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should consider restricting access to the invitation-code redemption endpoint or implementing additional authentication controls as a temporary mitigation until an official fix is released.