CVE-2026-90848

EUVD-2026-78245
A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 40.64%
Debian logo
Debian Releases
Debian Product
Codename
ausweisapp2
bookworm
unimportant
forky
2.6.1-1
fixed
sid
2.6.1-1
fixed
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ausweisapp2
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
Common Weakness Enumeration
References
https://turingpoint.de/en/advisories/tp-2026-113/
https://vuldb.com/cve/CVE-2026-90848
https://vuldb.com/submit/925923
https://vuldb.com/vuln/403403
https://vuldb.com/vuln/403403/cti
https://www.Governikus.de/loesungen/kundenprojekte/AusweisApp/