Description
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Government Accountability Office | Electronic Protest Docketing System (EPDS) | < 2026-02-22 | 2026-02-22 |
| Civilian Board of Contract Appeals | Electronic Docketing System (EDS) | < 2026-03-19 | 2026-03-19 |
Advisories 1
- VA-26-169-01 U.S. GAO EPDS and CBCA EDS multiple vulnerabilities CISA ICS & IT advisories · Jun 18, 2026