CVE-2026-127120: Governikus AusweisApp Mobile StartPAOSResponse cross site scripting

Published Nov 12, 2026

Updated

A vulnerability was found in Governikus AusweisApp Mobile up to 2.5.5. This impacts an unknown function of the component StartPAOSResponse Handler. Performing a manipulation of the argument ResultMessage results in cross site scripting. The attack can be initiated remotely. Upgrading to version 2.6.0 will fix this issue. Upgrading the affected component is advised. This CVE was requested by the vendor.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Governikus AusweisApp Mobile to a version that resolves this vulnerability.
Fixed in 2.6.0

Event History

Nov 12, 2026

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which versions need to be upgraded?

Governikus AusweisApp Mobile versions up to and including 2.5.5 are affected. Version 2.6.0 fixes the issue.

Does exploitation require an authenticated account or local access?

The attack can be initiated remotely, and the supplied vector lists no privileges required. User interaction is required for exploitation.

What input is involved in the vulnerability?

The issue is triggered by manipulating the ResultMessage argument handled by the StartPAOSResponse component, resulting in cross-site scripting.