Governikus AusweisApp StartPAOSResponse cross site scripting

published 2026-09-15 55 d ago modified 2026-10-26 13 d ago also EUVD-2026-78245

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits: 0; none known

A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor.

Patch / fix

fixed in 1 distros 1 links 1

Governikus AusweisApp 2.5.5

ausweisapp2 Debian 14 2.5.5-1

debian advisories DEBIAN-CVE-2026-90848

governikus.de/loesungen/kundenprojekte/AusweisApp/ patch

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 53 d ago (2026-09-16)

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C
CNA	3.0	4.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C
CNA	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CNA	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

Governikus AusweisApp

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-94 Improper Control of Generation of Code

References

governikus.de /loesungen/kundenprojekte/AusweisApp/
patch
vuldb.com /vuln/403403
vdb-entry, technical-description
vuldb.com /vuln/403403/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-90848
third-party-advisory
vuldb.com /submit/925923
third-party-advisory
turingpoint.de /en/advisories/tp-2026-113/
related

Sources

CVE List CVE-2026-90848
NVD CVE-2026-90848

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary