What’s Vulnerable › Vulnerabilities

CVE-2026-45248: Hedera Guardian Authentication Bypass Information Disclosure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-14 · updated 2026-10-26
• Weakness: CWE-306

Description

Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers to retrieve sensitive user information. Attackers can access the endpoint without providing authentication credentials to obtain usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users in the system.

Affected products

• hashgraph guardian: through 3.5.1

References

• https://github.com/hashgraph/guardian/pull/6076
• https://www.vulncheck.com/advisories/hedera-guardian-authentication-bypass-information-disclosure

Get alerted when CVE-2026-45248 or the next vulnerability affects your stack