EUVD-2026-37910
GHSA-w9xh-mqg8-v8fv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify target user ID on EPDS/EDS
-
DeliverySend unauthenticated POST to /update-profile/N
-
ExploitEndpoint accepts password change without auth
-
ExecutionAttacker logs in as victim
-
PersistAccess sealed protest/appeal filings
-
ImpactExfiltrate or tamper with procurement records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default deployments of the EPDS portal at epds.gao.gov and the EDS portal at eds.cbca.gov via the '/update-profile/N' API endpoint, where N is the target user's identifier. The only practical limiting factors are: the attacker must know or guess/enumerate a valid user ID (the 'N' path parameter), the targeted systems are narrow-scope U.S. federal portals rather than widely installed software so the attack surface is limited to two known hostnames, and exploitation was only possible during the pre-patch window (before 2026-02-22 for EPDS and before 2026-03-19 for EDS). |
| Impact | All available signals point to high real-world risk: CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N gives a 9.3 score with full VC/VI/VA high impact on the vulnerable system, meaning the attack is internet-reachable, requires no privileges, no user interaction, and no special attack conditions. The vulnerability was reported and coordinated by CISA (cisa-cg), which typically indicates verified, reproducible findings against live production systems. EPSS and KEV status are not provided in the input, and no public PoC is referenced, so although exploitation is technically trivial, observable in-the-wild activity is not confirmed. The conflicting signal worth flagging is that these are low-population, narrowly-scoped federal portals (not a widely deployed software product), so mass-scanning EPSS metrics may understate the targeted-attack risk against a high-value government tenant. |
| Exploit ScenarioDerived | An attacker who knows or can enumerate a target user identifier (for example, a contracting officer or attorney known to file protests) sends a single unauthenticated HTTP request to https://epds.gao.gov/update-profile/{N} (or the EDS equivalent) with a new password in the body, then logs in as that user to read sealed protest filings, exfiltrate procurement-sensitive documents, or submit fraudulent filings on behalf of the victim. No public exploit identified at time of analysis, but the attack requires only an HTTP client and a valid user ID, making weaponization trivial once the endpoint shape is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 18, 2026
Authentication bypass in the U.S. Government Accountability Office Electronic Protest Docketing System (EPDS) and the Civilian Board of Contract Appeals Electronic Docketing System (EDS) allows remote, unauthenticated attackers to reset arbitrary user passwords by calling the '/update-profile/N' API endpoint, which fails to verify the requester's identity. Successful exploitation results in full account takeover of any user - including potentially privileged accounts handling federal bid protests and contract appeals - with no public exploit identified at time of analysis but a CVSS 4.0 base score of 9.3 (Critical) and CISA Coordinated Disclosure tracking.
Earlier versions of this analysis (2)
Unauthenticated password reset on the GAO Electronic Protest Docketing System (EPDS) and CBCA Electronic Docketing System (EDS) allows remote attackers to take over any user account by issuing a request to the '/update-profile/N' API endpoint without credentials. The flaw stems from missing authentication checks on a password-change handler, enabling full account takeover of attorneys, contracting officers, and other docket participants. No public exploit has been identified at time of analysis, but the trivial nature of the bug and CVSS 4.0 score of 9.3 make it a high-priority issue.
Unauthenticated password reset in the U.S. GAO Electronic Protest Docketing System (EPDS) and the Civilian Board of Contract Appeals Electronic Docketing System (EDS) allows remote attackers to change the password of any user account by calling the '/update-profile/N' API endpoint without authentication. The flaw, reported by CISA CG and tracked with CVSS 9.8, lets adversaries fully take over arbitrary accounts and impersonate them within these federal docketing platforms. No public exploit identified at time of analysis, but the trivial nature of the missing authentication check makes weaponization straightforward once the endpoint is reachable.
RemediationAI
Both systems are vendor-hosted SaaS, so remediation has already been applied server-side by the operators: EPDS was patched on 2026-02-22 and EDS was patched on 2026-03-19 per the CISA CSAF advisory at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-01.json - no user-side patching is required, but agencies and law firms with EPDS/EDS accounts should review account activity, force a password reset on any account that did not initiate a reset, and enable multi-factor authentication if offered. Because the flaw was server-side and is now fixed at the source, no workaround is needed today; during the exposure window the only effective compensating control would have been blocking outbound access to epds.gao.gov and eds.cbca.gov from agency networks, which would have prevented legitimate filings and was therefore not a viable mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EPDS and EDS are web-based docketing portals hosted at epds.gao.gov and eds.cbca.gov used to file and manage federal bid-protest and contract-appeal cases. The flaw maps to CWE-306 (Missing Authentication for Critical Function): the '/update-profile/N' endpoint accepts a user identifier in the URL path and processes a password-change action without verifying that the caller is authenticated as that user (or authenticated at all). This is a classic Insecure Direct Object Reference combined with missing authentication on a state-changing API, indicating the password-change handler trusts the path-supplied user ID instead of binding the operation to an authenticated session.
Know when Electronic Protest Docketing System Epds gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Endpoint is internet-reachable with no auth and no user interaction (AV:N/AC:L/PR:N/UI:N); arbitrary password reset yields full account takeover, so C/I/A all High.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
5DescriptionCVE.org
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.
Executive ViewAI
A critical vulnerability in the U.S. Government Accountability Office's protest docketing system and the Civilian Board of Contract Appeals' electronic system allows unauthenticated attackers to remotely hijack user accounts; no public exploit identified at time of analysis. This creates immediate risk to the integrity of federal procurement processes, enabling unauthorized access to bid protests, contract appeals, and critical government contracting data.
Apply vendor patch. Interim mitigations: restrict network access to the '/update-profile/N' endpoint for unauthenticated users; require email verification and identity confirmation for all password resets; implement enhanced logging and real-time alerting on authentication-related activities; restrict EPDS and EDS access to trusted networks only until patching is complete.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation in the U.S. GAO Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals E
Insecure Direct Object Reference (IDOR) in the U.S. Government Accountability Office Electronic Protest Docketing System
Network access control bypass in the U.S. Government Accountability Office Electronic Protest Docketing System (EPDS) an
Exploit-DB