GAO EPDS EUVD-2026-37913

Exploitation requires two simultaneous conditions: (1) the attacker must possess valid, working administrator-level credentials for the target system - these cannot be derived from the X-Forwarded-For bypass itself and must be obtained through a separate compromise vector such as phishing or credential theft; and (2) the system must be enforcing IP-based network access controls via the application layer using the X-Forwarded-For header rather than at the network/transport layer. Exploitation is limited to attackers who have already cleared the significant barrier of administrator credential compromise. There is no indication that unauthenticated attackers or standard (non-admin) user accounts can leverage this bypass. The attack is not constrained to a specific platform or operating system and is executable from any internet-accessible host, but the administrative login endpoint is the specific entry point. The vulnerability does not provide privilege escalation on its own - it only enables an already-credentialed admin to authenticate from an otherwise-blocked network location.

The CVSS 3.1 base score of 4.7 (Medium) reflects an attack that, while network-accessible and requiring no user interaction, demands high-privilege credentials (PR:H) as a firm precondition - meaning the attacker must already control a valid administrator account. This substantially limits opportunistic exploitation; the vulnerability primarily serves as a secondary capability for a threat actor who has already cleared the harder hurdle of credential compromise. The CVSS impact metrics (C:L/I:L/A:L) are measured conservatively against the bypass itself rather than the full scope of what an authenticated administrator can accomplish once inside - defenders should consider that administrative access to federal procurement protest and contract appeals docketing systems may carry higher effective impact than the base score suggests, given the sensitivity of the legal proceedings involved. No EPSS score was supplied, no CISA KEV listing is present, and no public proof-of-concept code has been identified, all of which support a lower prioritization relative to other medium-CVSS vulnerabilities. The absence of a version constraint in both CPE strings (wildcard '*' versions) means the full exposure surface across deployed versions is unconfirmed.

A threat actor who has obtained valid administrator credentials for EPDS or EDS through phishing, credential stuffing, or a prior breach attempts to log in from an IP address outside the permitted government network range and would normally be blocked. By adding a forged 'X-Forwarded-For: 10.0.0.1' header (or any IP within the trusted range) to the HTTP login request, the attacker causes the application to evaluate the spoofed address as the connection source, bypassing the network access control and completing authentication to the administrative interface. No public proof-of-concept code is known to exist, but the technique is elementary and well-documented in security literature.