What is CVE-2026-54103?

CVE-2026-54103 is a critical-severity vulnerability in Civilian Board Of Contract Appeals Electronic Docketing System (Eds), classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2026-06-18.

How severe is CVE-2026-54103?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Civilian Board Of Contract Appeals Electronic Docketing System (Eds)

CVE-2026-54103

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profi…

Vulnerability class: Broken Authentication

EPSS: 0.008 (52.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Civilian Board Of Contract Appeals Electronic Docketing System (Eds) — versions 0, 2026-03-19
Government Accountability Office Electronic Protest Docketing System (Epds) — versions 0, 2026-02-22

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

9119a7d8-5eab-497f-8521-727c672e3725
9119a7d8-5eab-497f-8521-727c672e3725 (vdb-entry)
9119a7d8-5eab-497f-8521-727c672e3725 (product)
9119a7d8-5eab-497f-8521-727c672e3725 (product)

Frequently asked questions

What is CVE-2026-54103?: CVE-2026-54103 is a critical-severity vulnerability in Civilian Board Of Contract Appeals Electronic Docketing System (Eds), classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2026-06-18.
How severe is CVE-2026-54103?: Critical severity. CVSS v3 base score is 9.8 out of 10.