PT-2026-91827

CVE-2026-90848

Published

2026-09-15

Updated

2026-09-15

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Governikus AusweisApp versions prior to 2.5.5

Description A weakness in the StartPAOSResponse Handler component allows for remote cross site scripting. This occurs when the ResultMessage argument is manipulated, enabling an attacker to execute malicious scripts in the user's browser.

Recommendations Upgrade to version 2.5.5.

Exploitability

Fix

Impacts

Researchers

Governikus

Jan Kahmen

Jankahmen

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')