EUVD-2026-64673
GHSA-2j6w-5vh7-9pq6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint, no complexity or interaction required; impact limited to invitation code scope with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/v1/user_invitation_code.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing authentication. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Missing authentication on the public invitation-code redemption endpoint in open-wearables (versions up to and including 0.6.2) allows any unauthenticated remote attacker to call the redeem_invitation_code function and redeem invitation codes without authorization. The flaw exists in backend/app/api/routes/v1/user_invitation_code.py and requires only network access with no credentials, no user interaction, and no special configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The `redeem_invitation_code` endpoint at `backend/app/api/routes/v1/user_invitation_code.py` must be reachable over the network - the CVSS PR:N rating confirms no credentials are required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation with no attack prerequisites beyond reachability to the API server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker with network access to the open-wearables API server sends a crafted HTTP request to the public invitation-code redemption endpoint, supplying a guessed or brute-forced `code` value in the request body. Because no authentication check is enforced, the server processes the redemption directly, allowing the attacker to consume valid invitation codes and potentially self-register unauthorized accounts. … |
| Remediation | No vendor-released patch has been identified at time of analysis; the project maintainers had not responded to the responsible disclosure as of the report date (GitHub issue #1274: https://github.com/the-momentum/open-wearables/issues/1274). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today