CVE-2026-45248

Name of the Vulnerable Software and Affected Versions Hedera Guardian versions prior to 3.5.2

Description An authentication bypass exists in the 'GET /api/v1/demo/registered-users' endpoint. This allows unauthenticated attackers to retrieve sensitive user information, including usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users in the system.

Recommendations Update to a version newer than 3.5.1. As a temporary workaround, restrict access to the 'GET /api/v1/demo/registered-users' endpoint to minimize the risk of exploitation.