Description

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/v1/user_invitation_code.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing authentication. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-24T00:16:47.200Z",
  "pubdate": "2026-08-24T00:16:47.200Z",
  "executiveSummary": "A vulnerability has been identified in the-momentum open-wearables up to version 0.6.2, specifically within the Public Invitation-Code Redemption Endpoint. The flaw exists in the redeem_invitation_code function located in the backend/app/api/routes/v1/user_invitation_code.py file. This security issue stems from missing authentication controls, allowing unauthenticated remote threat actors to interact with sensitive invitation code redemption logic. The lack of proper access controls exposes the application to unauthorized manipulation of the code argument, potentially leading to unauthorized system state changes or resource access without requiring valid user credentials. Remote exploitation is fully feasible over the network, as the endpoint is exposed publicly without verifying the identity of the incoming request sender. The project maintainers were notified via an early issue report but have not yet provided an official response or patch. The risk implications include potential bypass of access restrictions and unauthorized function execution, making immediate manual hardening necessary until an upstream patch is released.",
  "technicalDetails": "The vulnerability is classified as a missing authentication flaw, occurring due to the absence of proper access control checks on a sensitive API endpoint. The vulnerable component is the Public Invitation-Code Redemption Endpoint implemented in the-momentum open-wearables up to version 0.6.2. Specifically, the flaw resides in the redeem_invitation_code function defined within the backend/app/api/routes/v1/user_invitation_code.py source file. In web application architectures, endpoints handling functional operations like invitation code redemption must validate session tokens, API keys, or user authentication headers prior to executing core business logic. In this case, the function processes incoming requests targeting the code argument without verifying whether the caller possesses an authenticated session or the appropriate privileges.\nThe attack flow enables remote exploitation over the network without requiring any prior authentication, specific privileges, or user interaction. An attacker can craft arbitrary HTTP requests directed at the invitation code redemption route and supply malicious or brute-forced inputs via the code argument. Because the application fails to enforce authentication boundaries, the backend processes the supplied parameter directly within the redeem_invitation_code function. Post-exploitation impact depends on the internal business logic tied to invitation code processing, but generally allows unauthorized entities to consume, validate, or manipulate invitation codes, potentially disrupting application workflows, bypassing registration controls, or gaining unauthorized access privileges associated with valid invitation codes. The root cause is an architectural omission of authentication decorators or middleware checks on the designated API route handler."
}