Missing Authentication in Open-Wearables Invitation Code Redemption

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/v1/user_invitation_code.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing authentication. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The-momentum open-wearables versions up to 0.6.2 contain a critical authentication bypass in the public invitation-code redemption endpoint. By manipulating the 'code' parameter in the backend/app/api/routes/v1/user_invitation_code.py file, attackers can redeem invitation codes without proper authentication verification. This vulnerability affects any deployment using the vulnerable component versions and could allow unauthorized users to gain access to accounts or functionality intended only for legitimate invitees. The lack of response from the project maintainers increases risk exposure for existing installations.

Casky's 754 security skills, powered by Claude AI's extended reasoning, map this vulnerability to MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify 283 matching skills that detect authentication bypass patterns, including detection of anomalous invitation code submissions lacking proper session validation, suspicious account creation immediately following code redemption attempts, and API endpoint access without corresponding authentication tokens. The platform's analysis would surface CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function) findings, enabling security teams to correlate these signals with user behavior analytics to identify compromised accounts and investigate unauthorized access chains before lateral movement occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-78154.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-78154

Casky has 283 skills that investigate the attack patterns behind CVE-2026-78154. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn