CVE-2026-45248 is an authentication bypass vulnerability affecting Hedera Guardian through version 3.5.1. The issue exists in the GET /api/v1/demo/registered-users endpoint, which does not require authentication, allowing attackers to access sensitive user data such as usernames, Hedera decentralized identifiers (DIDs), parent registry DIDs, system roles, and policy role assignments. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity) with network attack vector, low complexity, and no privileges or user interaction required. No official remediation or patch information is provided in the available data.

An unauthenticated attacker can access sensitive user information from the affected Hedera Guardian system. This exposure includes usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users. Such information disclosure could facilitate further targeted attacks or reconnaissance but does not directly indicate privilege escalation or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoint by implementing network-level controls such as firewall rules or API gateway authentication enforcement to prevent unauthenticated access. Monitor for updates from the vendor regarding patches or official mitigations.