CVE-2026-45248 is an authentication bypass vulnerability affecting Hedera Guardian through version 3.5.1. The issue exists in the GET /api/v1/demo/registered-users API endpoint, which does not require authentication, enabling attackers to access sensitive user data such as usernames, Hedera decentralized identifiers (DIDs), parent registry DIDs, system roles, and policy role assignments. This exposure could lead to information disclosure but does not require privileges or user interaction. The vulnerability is rated medium severity with a CVSS 4.0 base score of 6.9. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Unauthenticated attackers can retrieve sensitive user information from the affected endpoint, potentially compromising user privacy and system confidentiality. The exposed data includes usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users. This could facilitate further targeted attacks or unauthorized access attempts based on the disclosed information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable endpoint by implementing network-level controls or authentication proxies to prevent unauthenticated access. Monitor for updates from the vendor regarding patches or official mitigations.