Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-78154
the-momentum open-wearables Public Invitation-Code Redemption Endpoint user_invitation_code.py redeem_invitation_code missing authentication
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L N N N L L L 6.9 .0040 33.4 —
AFFECTED
Product Versions Fixed
open-wearables 0.6.0 – —
TIMELINE
Aug 23 Reserved by VulDB
Aug 23 Published (CNA: VulDB)
Aug 25 REJECTED — CVE-2026-78154 (the-momentum open-wearables). Record withdrawn by the CNA.
Description
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The endpoint is public on purpose and the invitation code is the credential. This is the standalone SDK onboarding path for mobile apps that have no backend of their own: a developer generates a code via the authenticated dashboard endpoint, the user types it into the app, and it's redeemed for SDK-scoped tokens.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| August 23, 2026 | Reserved | Reserved by VulDB |
| August 23, 2026 | Published | Published (CNA: VulDB) |
| August 25, 2026 | REJECTED | REJECTED — CVE-2026-78154 (the-momentum open-wearables). Record withdrawn by the CNA. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| the-momentum | open-wearables | — | 0.6.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-78154 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
