Governikus AusweisApp Desktop StartPAOSResponse cross site scripting
Summary
| CVE | CVE-2026-90848 |
|---|---|
| State | PUBLISHED |
| Assigner | VulDB |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-15 02:16:48 UTC |
| Updated | 2026-11-12 16:19:21 UTC |
| Description | A weakness has been identified in Governikus AusweisApp Desktop up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor. |
Risk And Classification
Primary CVSS: v4.0 5.3 MEDIUM from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.004700000 probability, percentile 0.404980000 (date 2026-10-27)
Problem Types: CWE-79 | CWE-94 | CWE-79 Cross Site Scripting | CWE-94 Code Injection
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 5.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | DECLARED | 5.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X |
| 3.1 | [email protected] | Secondary | 4.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| 3.1 | CNA | DECLARED | 4.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C |
| 3.0 | CNA | DECLARED | 4.3 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C |
| 2.0 | [email protected] | Secondary | 5 | AV:N/AC:L/Au:N/C:N/I:P/A:N | |
| 2.0 | CNA | DECLARED | 5 | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v3.0 Breakdown
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Governikus | AusweisApp Desktop | affected 2.5.0 | Not specified |
| CNA | Governikus | AusweisApp Desktop | affected 2.5.1 | Not specified |
| CNA | Governikus | AusweisApp Desktop | affected 2.5.2 | Not specified |
| CNA | Governikus | AusweisApp Desktop | affected 2.5.3 | Not specified |
| CNA | Governikus | AusweisApp Desktop | affected 2.5.4 | Not specified |
| CNA | Governikus | AusweisApp Desktop | unaffected 2.5.5 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| vuldb.com/cve/CVE-2026-90848 | [email protected] | vuldb.com | |
| vuldb.com/vuln/403403/cti | [email protected] | vuldb.com | |
| turingpoint.de/en/advisories/tp-2026-113 | [email protected] | turingpoint.de | |
| www.Governikus.de/loesungen/kundenprojekte/AusweisApp | [email protected] | www.Governikus.de | |
| vuldb.com/submit/925923 | [email protected] | vuldb.com | |
| vuldb.com/vuln/403403 | [email protected] | vuldb.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Jan Kahmen (turingpoint GmbH) (en)
CNA: governikus (VulDB User) (en)
CNA: jankahmen (VulDB User) (en)
CNA: VulDB CNA Team (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-09-14T00:00:00.000Z | Advisory disclosed |
| CNA | 2026-09-14T02:00:00.000Z | VulDB entry created |
| CNA | 2026-11-12T16:30:25.000Z | VulDB entry last update |