CVE-2026-90848: Governikus AusweisApp StartPAOSResponse cross site scripting
A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Governikus AusweisAppto a version that resolves this vulnerability.Fixed in 2.5.5
Event History
Frequently Asked Questions
Which releases should be prioritized for remediation?
Governikus AusweisApp versions up to and including 2.5.4 are affected. Upgrading to version 2.5.5 addresses the issue.
Can this be exploited remotely without authentication?
The vulnerability can be launched remotely, and the vector indicates no privileges are required. Exploitation does require user interaction.
What input is involved in the attack?
The issue involves manipulation of the ResultMessage argument handled by the StartPAOSResponse component. Successful manipulation can result in cross-site scripting.