Hedera Guardian contains an authentication bypass in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers to retrieve usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users. This flaw, identified as CWE‑306, permits full disclosure of user data without any authentication, constituting a medium‑severity information‑disclosure vulnerability.

Hashgraph’s Hedera Guardian product is affected, specifically version 3.5.1 and earlier releases that have not applied the fix for the authentication bypass. Administrators should verify that their deployed Guardian instance matches or exceeds the patched release.

The CVSS score is 6.9, indicating medium severity. Because no authentication is required, attackers can exploit the flaw from any network where the Guardian service is reachable, such as a public web server. The EPSS score is currently unavailable and the vulnerability is not listed in CISA’s KEV catalog, but the lack of mitigations and the publicly documented behavior suggest that an attacker with network access could retrieve all user data readily.