CVE-2026-127120
Deferred Deferred - Pending Action

Cross-Site Scripting in Governikus AusweisApp Mobile

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: VulDB

Description
A vulnerability was found in Governikus AusweisApp Mobile up to 2.5.5. This impacts an unknown function of the component StartPAOSResponse Handler. Performing a manipulation of the argument ResultMessage results in cross site scripting. The attack can be initiated remotely. Upgrading to version 2.6.0 will fix this issue. Upgrading the affected component is advised. This CVE was requested by the vendor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-127120
EUVD
EUVD-2026-124657

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
governikus ausweisapp_mobile to 2.5.5 (inc)
governikus ausweisapp_mobile 2.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in the Governikus AusweisApp Mobile up to version 2.5.5. It involves manipulation of the ResultMessage argument in the StartPAOSResponse Handler component, allowing remote attackers to inject malicious scripts.

Detection Guidance

This vulnerability is specific to the Governikus AusweisApp Mobile up to version 2.5.5 and involves a cross-site scripting issue in the StartPAOSResponse Handler component. Detection would require checking the installed version of the app. If the version is 2.5.5 or lower, the system is vulnerable.

Impact Analysis

An attacker could exploit this to execute arbitrary scripts in a user's browser, potentially stealing session cookies, sensitive data, or performing actions on behalf of the user. This could lead to unauthorized access or data breaches.

Compliance Impact

This vulnerability could compromise data confidentiality and integrity, violating GDPR principles like data protection by design and HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties.

Mitigation Strategies

Upgrade the Governikus AusweisApp Mobile to version 2.6.0 or later, as this version fixes the vulnerability. Ensure no other components or dependencies are using the vulnerable version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127120. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...