{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-08-25T08:26:02.821Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The endpoint is public on purpose and the invitation code is the credential. This is the standalone SDK onboarding path for mobile apps that have no backend of their own: a developer generates a code via the authenticated dashboard endpoint, the user types it into the app, and it\u0027s redeemed for SDK-scoped tokens."
        }
      ],
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-78154",
    "datePublished": "2026-08-23T23:30:09.983Z",
    "dateRejected": "2026-08-25T08:26:02.821Z",
    "dateReserved": "2026-08-23T07:42:52.545Z",
    "dateUpdated": "2026-08-25T08:26:02.821Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-78154",
      "date": "2026-08-24",
      "epss": "0.00405",
      "percentile": "0.33394"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-78154\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2026-08-24T00:16:47.200\",\"lastModified\":\"2026-08-25T09:17:35.967\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The endpoint is public on purpose and the invitation code is the credential. This is the standalone SDK onboarding path for mobile apps that have no backend of their own: a developer generates a code via the authenticated dashboard endpoint, the user types it into the app, and it\u0027s redeemed for SDK-scoped tokens.\"}],\"metrics\":{},\"references\":[]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-24T17:48:42.459Z\"}, \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-78154\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-24T17:47:50.689224Z\"}}}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"the-momentum open-wearables Public Invitation-Code Redemption Endpoint user_invitation_code.py redeem_invitation_code missing authentication\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Aston (VulDB User)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"VulDB CNA Team\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6.9, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 7.5, \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:the-momentum:open-wearables:*:*:*:*:*:*:*:*\"], \"vendor\": \"the-momentum\", \"modules\": [\"Public Invitation-Code Redemption Endpoint\"], \"product\": \"open-wearables\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.6.0\"}, {\"status\": \"affected\", \"version\": \"0.6.1\"}, {\"status\": \"affected\", \"version\": \"0.6.2\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-08-23T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2026-08-23T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-08-23T09:47:57.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/vuln/394536\", \"name\": \"VDB-394536 | the-momentum open-wearables Public Invitation-Code Redemption Endpoint user_invitation_code.py redeem_invitation_code missing authentication\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/vuln/394536/cti\", \"name\": \"VDB-394536 | CTI Indicators (IOB, IOC, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/cve/CVE-2026-78154\", \"name\": \"CVE-2026-78154 | CVE Analysis and Report\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://vuldb.com/submit/882887\", \"name\": \"Submit #882887 | self-hosted the-momentum/open-wearables main v\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/the-momentum/open-wearables/issues/1274\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://github.com/the-momentum/open-wearables/\", \"tags\": [\"product\"]}], \"x_generator\": [\"VulDB PVTS v202608\"], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/v1/user_invitation_code.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing authentication. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"Missing Authentication\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"Improper Authentication\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-08-23T23:30:09.983Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-78154\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-24T17:49:10.667Z\", \"dateReserved\": \"2026-08-23T07:42:52.545Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2026-08-23T23:30:09.983Z\", \"assignerShortName\": \"VulDB\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}