Vulnerability · Published May 14, 2026 · Assigned by VulnCheck

CVE-2026-45248Hedera Guardian Authentication Bypass Information Disclosure

Medium 5.3

In plain English

A medium-severity missing authentication in guardian from hashgraph. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 70.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers to retrieve sensitive user information. Attackers can access the endpoint without providing authentication credentials to obtain usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users in the system.

Affected products (as reported)

Vendor	Product	Versions
hashgraph	guardian	0 – through 3.5.1

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/hashgraph/guardian/pull/6076 issue-tracking
https://www.vulncheck.com/advisories/hedera-guardian-authentication-bypass-information-disclosure third-party-advisory