CVE-2026-127120 · Other
NO FIX YET · SEE WHAT TO DO
AusweisApp Mobile, the German national eID authentication app, fails to handle the ResultMessage argument in its StartPAOS response handler safely. An attacker who can get a crafted value into that message can run scripts in the app's web context.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Users of AusweisApp Mobile up to version 2.5.5 who authenticate with their German eID through the app. The sources do not say whether integrating services or businesses are affected beyond the app itself.
Not affected if version-2.6.0-or-later
Who cares ausweisapp-mobile, german-eid, governikus, mobile
2.5.5 are affected.2.6.0A vulnerability was found in Governikus AusweisApp Mobile up to 2.5.5. This impacts an unknown function of the component StartPAOSResponse Handler. Performing a manipulation of the argument ResultMessage results in cross site scripting. The attack can be initiated remotely. Upgrading to version 2.6.0 will fix this issue. Upgrading the affected component is advised. This CVE was requested by the vendor.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.