# CVE-2026-54103: GAO and CBCA Docketing Systems authentication bypass in password reset API

Source: https://junglewise.ai/threats/cve-2026-54103-gao-and-cbca-docketing-systems-authentication-bypass-in-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-54103 · Severity: critical · CVSS 9.8 · Published 2026-06-18

The U.S. Government Accountability Office (GAO) and the Civilian Board of Contract Appeals (CBCA) use electronic docketing systems to manage legal protests and contract appeals. A security flaw in these systems allows anyone on the internet to change any user's password without needing to log in first. This could lead to unauthorized access to sensitive legal filings, disruption of government proceedings, and full account takeover of system users.

Technologies: [Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS)](https://junglewise.ai/threats/technologies/electronic-docketing-system-eds), [Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS)](https://junglewise.ai/threats/technologies/electronic-protest-docketing-system-epds). Vendors: [Civilian Board of Contract Appeals (CBCA)](https://junglewise.ai/threats/vendors/civilian-board-of-contract-appeals-cbca), [Government Accountability Office (GAO)](https://junglewise.ai/threats/vendors/government-accountability-office-gao).

## Quick answers

**Is CVE-2026-54103 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54103 being exploited in the wild.

**How severe is CVE-2026-54103?** Critical severity, with a CVSS score of 9.8, published 18 June 2026.

**Which products and versions are affected?** Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) Versions prior to 2026-03-19; Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) Versions prior to 2026-02-22.

**Is there a fix for CVE-2026-54103?** A patch was published on 2026-02-22: GAO EPDS patch date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54103 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-54103?** Check whether you run Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) or Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as a missing authentication for a critical function (CWE-306) within the '/update-profile/N' API endpoint. The application fails to verify the identity or session of a requester before processing password update commands. A remote, unauthenticated attacker can exploit this by sending a crafted request to the vulnerable endpoint to change the password of any targeted user account. This provides a direct path to full account takeover. The issue has been addressed in the GAO EPDS as of February 22, 2026, and in the CBCA EDS as of March 19, 2026.

## Affected products

- Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) Versions prior to 2026-02-22
- Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) Versions prior to 2026-03-19

## Timeline

- 2026-02-22: patched: GAO EPDS patch date
- 2026-03-19: patched: CBCA EDS patch date
- 2026-06-18: disclosed

## References

- [https://epds.gao.gov/](https://epds.gao.gov/)
- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json)
- [https://www.cve.org/CVERecord?id=CVE-2026-54103](https://www.cve.org/CVERecord?id=CVE-2026-54103)
- [https://www.eds.cbca.gov/login](https://www.eds.cbca.gov/login)