Hedera Guardian Authentication Bypass Vulnerability in Registered Users Endpoint

An authentication bypass vulnerability has been identified in Hedera Guardian versions through 3.5.1. The issue resides in the GET /api/v1/demo/registered-users endpoint, allowing unauthenticated attackers to access sensitive user information. Exploitation of this vulnerability enables the retrieval of usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users within the system.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive user information, including usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users.

Remediation

Users can update to Hedera Guardian version 3.5.2 or later, where this vulnerability has been addressed.