This CVE has been withdrawn by MITRE

MITRE marked CVE-2026-78154 as REJECTED on August 25, 2026. There is no longer a valid blast radius to assess. Any historical package or vendor data shown below is preserved for audit reference only.

Reason given by MITRE

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The endpoint is public on purpose and the invitation code is the credential. This is the standalone SDK onboarding path for mobile apps that have no backend of their own: a developer generates a code via the authenticated dashboard endpoint, the user types it into the app, and it's redeemed for SDK-scoped tokens.

CVE-2026-78154 Blast Radius

✕ WITHDRAWN — HISTORICAL DATAA vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/ap…

← Back to CVE-2026-78154