CVE-2026-54103: U.S. GAO EPDS and CBCA EDS unauthenticated password change

Synopsis

This is an authentication bypass vulnerability in the U.S. GAO Electronic Protest Docketing System (EPDS) and the CBCA Electronic Docketing System (EDS). The flaw is reachable over the network with no credentials required: the '/update-profile/N' API endpoint accepts password change requests without verifying the caller's identity. A remote, unauthenticated attacker can overwrite any user's password, enabling full account takeover across both systems. Patched-image rebuilds at versions 2026-02-22 (EPDS) and 2026-03-19 (EDS) are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the target host.

• AuthenticationNot required

  No credentials of any kind are needed; the '/update-profile/N' endpoint processes password change requests without authenticating the caller.

• Victim interactionNot required

  The attacker acts entirely on their own without any action required from the targeted user.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layout, or environmental factors are required.

Blast Radius

• An attacker sets an arbitrary password for any user account, achieving full account takeover without prior access.
• With control of a user account, the attacker reads that user's docketed case records, filings, and any personally identifiable information stored in the profile.
• The attacker can modify or submit docketing entries on behalf of the hijacked account, tampering with official protest or contract appeal records.
• Mass account takeover is feasible by iterating over user identifiers, disrupting access for all legitimate users of either system.