CVE-2026-90848
Governikus AusweisApp StartPAOSResponse cross site scripting
A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Governikus AusweisApp StartPAOSResponse cross site scripting
A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor.
- Record
CVE-2026-90848- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C - CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C - CVSS 2.0
- 5.0
AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C - Weakness
- CWE-79, CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2026-78245
A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor.
- Record
EUVD-2026-78245- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-492q-f4p6-w72v
A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown...
A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor.
- Record
GHSA-492q-f4p6-w72v- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor.
- Record
CVE-2026-90848- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-79, CWE-94
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-90848
A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor.
- Record
DEBIAN-CVE-2026-90848- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-90848
A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor.
- Record
UBUNTU-CVE-2026-90848- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ausweisapp2Debian:12 | All versions, plus listed versions 1.26.2-11.26.3-11.26.4-11.26.5-11.26.5-1~bpo11+1 Show 34 moreShow less1.26.5-1~bpo12+11.26.6-11.26.7-11.26.7-21.26.7-2~bpo11+11.26.7-2~bpo12+12.0.0-12.0.1-12.0.1-1~bpo12+12.0.2-12.0.3-12.1.0-12.1.1-12.1.1-22.2.0-12.2.0-22.2.1-12.2.1-22.2.2-12.3.0-12.3.1-12.3.2-12.3.2-1~bpo13+12.4.0-12.4.0-22.4.0-2~bpo13+12.4.1-12.5.0-12.5.1-12.5.3-12.5.4-12.5.5-12.6.0-12.6.1-1 | None known |
ausweisapp2Debian:13 | All versions, plus listed versions 2.3.1-12.3.2-12.3.2-1~bpo13+12.4.0-12.4.0-2 Show 9 moreShow less2.4.0-2~bpo13+12.4.1-12.5.0-12.5.1-12.5.3-12.5.4-12.5.5-12.6.0-12.6.1-1 | None known |
ausweisapp2Debian:14 | before 2.5.5-1, plus listed versions 2.3.1-12.3.2-12.3.2-1~bpo13+12.4.0-12.4.0-2 Show 6 moreShow less2.4.0-2~bpo13+12.4.1-12.5.0-12.5.1-12.5.3-12.5.4-1 | 2.5.5-1 |
ausweisapp2Ubuntu:20.04:LTS | All versions, plus listed versions 1.18.2-11.20.0-11.20.0-1build1 | None known |
ausweisapp2Ubuntu:22.04:LTS | All versions, plus listed versions 1.22.2-11.22.2-1build11.22.3-11.22.4-1 | None known |
ausweisapp2Ubuntu:24.04:LTS | All versions, plus listed versions 1.26.7-11.26.7-22.0.0-12.0.1-12.0.2-12.0.3-12.1.0-12.1.0-1build1 | None known |
ausweisapp2Ubuntu:26.10 | All versions, plus listed versions 2.5.0-12.5.1-12.5.1-1build12.5.3-12.5.4-1ubuntu12.6.0-1 | None known |
ausweisapp2Ubuntu:26.04:LTS | All versions, plus listed versions 2.3.2-12.4.0-12.4.0-22.4.1-12.5.0-1 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-90848 is a medium vulnerability (CVSS 5.3) in Governikus Ausweisapp, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in ausweisapp2 2.5.5-1.