CVE-2026-54106 — U.S. GAO EPDS and CBCA EDS network access control bypass
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not…
Published: 2026-06-18 · CVSS: 5.1 · CVSS 4.0
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7