CVE-2026-54103 identifies a critical authentication bypass vulnerability in the GAO EPDS and CBCA EDS systems. Specifically, the '/update-profile/N' API endpoint that handles password change requests does not enforce authentication, enabling remote attackers without any privileges to change arbitrary user passwords. This flaw violates secure authentication practices (CWE-306) and can lead to full account compromise. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its ease of exploitation (network vector, no privileges required, no user interaction) and severe impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can change any user's password, potentially gaining unauthorized access to user accounts. This compromises user confidentiality and integrity, and can disrupt availability by locking out legitimate users. The critical CVSS score of 9.8 reflects the high risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the affected API endpoint if possible and monitor for suspicious activity related to password changes.