CVE-2026-54103: GAO EPDS and CBCA EDS: Missing Authentication on Password Change Endpoint
CVE-2026-54103 describes a missing authentication flaw (CWE-306) in the GAO Electronic Protest Docketing System (EPDS) and the CBCA Electronic Docketing System (EDS), where password change requests to the '/update-profile/N' API endpoint are not authenticated. A remote, unauthenticated attacker could change an arbitrary user's password, and the CNA rates the issue critical (CVSS v3.1 9.8). No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-54103 affects two U.S. government web docketing services: the GAO Electronic Protest Docketing System (EPDS) and the CBCA Electronic Docketing System (EDS). According to the CVE record, password change requests sent to the '/update-profile/N' API endpoint are not authenticated. The weakness is classified as CWE-306, Missing Authentication for Critical Function. The record was published on 2026-06-18 and is listed by NVD as "Awaiting Analysis". A CISA CSAF advisory (va-26-169-01) is referenced.
Impact
The CNA assigned a CVSS v3.1 base score of 9.8 (critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 score of 9.3. The record states that a remote, unauthenticated attacker could change an arbitrary user's password. In practice this would amount to account takeover: an attacker could lock legitimate users out and act under their identity, potentially accessing or altering bid protest and contract appeal filings tied to those accounts. The specific data exposed depends on each account's role, which the record does not detail.
Affected products and versions
- GAO Electronic Protest Docketing System (EPDS) — epds.gao.gov
- CBCA Electronic Docketing System (EDS) — eds.cbca.gov
The record does not list affected or fixed versions. Both appear to be centrally hosted web services rather than software installed by end users.
Exploitation status
The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record. The low attack complexity and lack of required privileges mean the flaw would be straightforward to abuse if still present.
Remediation and mitigation
Because these are hosted services, the fix must be applied by the operating agencies; the record contains no fix information, which does not imply that no fix exists.
- Operators should enforce authentication and authorization on the password change endpoint, verifying that the requester owns the targeted account (for example, requiring the current password or a valid session bound to that user).
- Users of EPDS or EDS should consult the CISA CSAF advisory and any notices from GAO or CBCA, verify they can still log in, and report unexpected lockouts.
- Where available, enable multi-factor authentication and review account contact details and recent filings for unauthorized changes.
Detection guidance
- Review application logs for password change requests to the profile update endpoint that lack an associated authenticated session, or where the session user differs from the target account.
- Look for bursts of profile update requests iterating over different user identifiers from the same source.
- Correlate password changes with subsequent logins from unfamiliar locations and with user reports of lockouts.
Limitations of the available information
The record provides no affected or fixed version data, no remediation timeline, no EPSS or SSVC data, and NVD has not yet completed its analysis. It is unknown whether the services have already been corrected or whether any accounts were compromised. The CNA is identified only by an internal identifier.
Frequently asked questions
What is CVE-2026-54103?
A missing authentication flaw in the GAO EPDS and CBCA EDS docketing systems: the '/update-profile/N' API endpoint does not authenticate password change requests, allowing a remote, unauthenticated attacker to change any user's password.
Is it being exploited in the wild?
It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should users do?
The fix must be applied by the operating agencies. Users should follow the CISA advisory and agency notices, confirm they can still log in, report unexpected lockouts and review their account for unauthorized changes.
Which versions are affected?
The record does not list versions; the affected items are hosted web services.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.