CVE-2026-45248 — The GET /Api/V1/Demo/Registered-Users Endpoint That Authentication Bypass

title: Authentication Bypass via Unauthenticated /api/v1/demo/registered-users Endpoint — CVE-2026-45248
id: scw-2026-05-14-ai-1
status: experimental
level: critical
description: |
  Detects unauthenticated GET requests to the '/api/v1/demo/registered-users' endpoint in Hedera Guardian, which is indicative of exploitation of CVE-2026-45248. This vulnerability allows attackers to bypass authentication and retrieve sensitive user information.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-45248/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-method:
          - 'GET'
      cs-uri:
          - '/api/v1/demo/registered-users'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse