A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/v1/user_invitation_code.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing authentication. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

A missing authentication vulnerability was identified in the-momentum open-wearables project up to version 0.6.2. The flaw resides in the redeem_invitation_code function within backend/app/api/routes/v1/user_invitation_code.py, part of the Public Invitation-Code Redemption Endpoint. By manipulating the 'code' argument, an unauthenticated remote attacker can exploit the endpoint without proper authentication checks. This allows unauthorized access to invitation code redemption functionality. The vulnerability is remotely exploitable, increasing its risk surface. The project maintainers were notified via an issue report but have not responded or issued a fix as of the time of disclosure. The lack of response raises concerns about the project's security posture and patch availability. Users of open-wearables up to version 0.6.2 are potentially exposed. No patch or workaround has been officially released.