CVE-2026-54103 describes a critical authentication bypass vulnerability in the GAO EPDS and CBCA EDS systems. Specifically, the '/update-profile/N' API endpoint does not require authentication for password change requests, enabling remote attackers without any privileges to arbitrarily change user passwords. This missing authentication on a critical function leads to full compromise potential of user accounts. The vulnerability is confirmed and published with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No official patch or remediation level has been disclosed by the vendor as of the publication date.

An unauthenticated remote attacker can change any user's password, leading to complete compromise of affected user accounts. This impacts confidentiality, integrity, and availability of the system and user data. Given the critical nature of the affected systems (government docketing systems), this could severely disrupt operations and expose sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint where possible and monitor for suspicious activity related to password changes. Implement compensating controls such as network-level restrictions or multi-factor authentication if feasible.