CVE-2026-78154

The CVSS 7.3 score for this invitation-code authentication bypass is misleading in a wearables context. The technical finding—a missing authentication check on the code redemption endpoint—is straightforward, but the downstream risk extends far beyond a registration bypass. In wearable ecosystems, invitation codes typically do more than admit new users. They gate device pairing permissions, premium feature access, and in some cases, social features that aggregate biometric data from paired devices. An unauthenticated actor who can arbitrarily redeem codes may be able to hijack device access, claim referral rewards meant for verified users, or force associations with accounts that hold health telemetry. The CVSS formula treats this as a bounded authorization flaw because it cannot model how invitation codes function as access-control infrastructure in your specific architecture. You must model that yourself. The non-response to the disclosure report is a critical signal. Either the project is abandoned or the maintainer does not prioritize security fixes—either way, do not rely on an official patch timeline. Treat this as a vulnerability with no fix commitment. Practically, treat the invitation-code flow as a high-sensitivity authorization boundary regardless of its original intended use. Audit whether your redemption endpoint validates authentication, and extend that audit to adjacent surfaces: device-pairing flows, referral reward mechanisms, and premium tier gating. These typically share the same architectural assumptions and often have parallel gaps. If this codebase is open-source or used as a dependency, recognize that the vulnerable endpoint will persist in forks and archived copies long after the parent project is defunct—invitation-code endpoints are architecturally designed to be forgotten, but they rarely are. The blast radius includes not just your users but their health data. Users of consumer IoT wearables do not monitor CVE feeds and have no recourse if their invitation code was leveraged to access their biometric streams. Assume the exposure is broader than the code-level finding suggests.

Reviewed through automated stages and approved by a human before publication.