Description
A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor.
Published: 2026-09-15
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross Site Scripting
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a reflected cross‑site scripting flaw located in the StartPAOSResponse handler of Governikus AusweisApp. An attacker can manipulate the ResultMessage argument, causing the application to render and execute arbitrary HTML or JavaScript in the victim’s browser. This can lead to session hijacking, credential theft, or malicious content injection, exploiting conventional input validation weaknesses (CWE‑79) and potential dynamic code evaluation (CWE‑94).

Affected Systems

Governikus AusweisApp versions up to and including 2.5.4 are affected. The flaw resides in the StartPAOSResponse handler component; upgrading to version 2.5.5 or later removes the weakness.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is < 1%, and the flaw is not listed in the CISA KEV catalog. The attack vector is remote, as a client‑side attacker can supply a crafted ResultMessage to a user running the application, resulting in reflected XSS in a browser or web view component.

Generated by OpenCVE AI on September 17, 2026 at 18:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Governikus AusweisApp to version 2.5.5 or later to eliminate the XSS flaw.
  • If an upgrade cannot be performed immediately, disable or block the StartPAOSResponse feature so that untrusted ResultMessage data is no longer processed.
  • Implement strict input validation and context‑sensitive output encoding for any data passed to the StartPAOSResponse handler to prevent script injection.
  • Avoid or restrict the use of eval‑style constructs when handling ResultMessage content to mitigate the CWE‑94 risk.

Generated by OpenCVE AI on September 17, 2026 at 18:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor.
Title Governikus AusweisApp StartPAOSResponse cross site scripting
First Time appeared Governikus
Governikus ausweisapp
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:governikus:ausweisapp:*:*:*:*:*:*:*:*
Vendors & Products Governikus
Governikus ausweisapp
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Governikus Ausweisapp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-16T16:55:26.870Z

Reserved: 2026-09-14T05:24:00.388Z

Link: CVE-2026-90848

cve-icon Vulnrichment

Updated: 2026-09-16T16:55:21.579Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T02:16:48.780

Modified: 2026-09-16T17:18:18.380

Link: CVE-2026-90848

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T21:15:14Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')