Cross Site Scripting Vulnerability in Governikus AusweisApp by Governikus
CVE-2026-90848

5.3MEDIUM

Key Information:

Vendor

Governikus

Status
AusweiSAPp
Vendor
CVE Published:
15 September 2026

What is CVE-2026-90848?

A security flaw has been detected in the Governikus AusweisApp, specifically in the StartPAOSResponse Handler component. This vulnerability allows for cross site scripting (XSS) by manipulating the ResultMessage argument, potentially enabling remote attackers to execute harmful scripts in the context of the user's session. Users are strongly advised to upgrade to version 2.5.5 to remediate this issue and enhance security against such attacks.

Affected Version(s)

AusweisApp 2.5.0

AusweisApp 2.5.1

AusweisApp 2.5.2

References

https://vuldb.com/vuln/403403
vdb-entrytechnical-description
https://vuldb.com/vuln/403403/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90848
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

governikus (VulDB User)
VulDB CNA Team
.