{"id":"CVE-2026-127120","kind":"vulnerability","aliases":["CVE-2026-127120"],"related":[],"title":"Governikus AusweisApp Mobile: manipulated result message enables cross-site scripting","description":"A vulnerability was found in Governikus AusweisApp Mobile up to 2.5.5. This impacts an unknown function of the component StartPAOSResponse Handler. Performing a manipulation of the argument ResultMessage results in cross site scripting. The attack can be initiated remotely. Upgrading to version 2.6.0 will fix this issue. Upgrading the affected component is advised. This CVE was requested by the vendor.","summary":"AusweisApp Mobile, the German national eID authentication app, fails to handle the ResultMessage argument in its StartPAOS response handler safely. An attacker who can get a crafted value into that message can run scripts in the app's web context.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ausweisapp-mobile","german-eid","governikus","mobile","other"],"not_affected_if":["version-2.6.0-or-later"],"how_to_check":"- Check the installed AusweisApp Mobile version in the app's about screen or store listing; versions up to `2.5.5` are affected.","fix":"- AusweisApp Mobile: upgrade to `2.6.0`","status":"open","published_at":"2026-11-12T20:18:34+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","triaged_at":"2026-11-12T20:42:24+00:00","updated_at":"2026-11-12T20:42:24+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T20:42:24Z","model":"claude-haiku-5-5","output":{"fix":"- AusweisApp Mobile: upgrade to `2.6.0`","reach":"internet","title":"Governikus AusweisApp Mobile: manipulated result message enables cross-site scripting","impact":"medium","summary":"AusweisApp Mobile, the German national eID authentication app, fails to handle the ResultMessage argument in its StartPAOS response handler safely. An attacker who can get a crafted value into that message can run scripts in the app's web context.","audience":"everyone","category":"other","nicknames":[],"who_cares":["ausweisapp-mobile","governikus","mobile","german-eid"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Scripts run in the app's web context, possibly reading authentication data.","analyst_note":"","how_to_check":"- Check the installed AusweisApp Mobile version in the app's about screen or store listing; versions up to `2.5.5` are affected.","plain_action":"Update the AusweisApp Mobile app to version 2.6.0 or later from your app store.","product_name":"","needs_analyst":false,"not_affected_if":["version-2.6.0-or-later"],"who_is_affected":"Users of AusweisApp Mobile up to version 2.5.5 who authenticate with their German eID through the app. The sources do not say whether integrating services or businesses are affected beyond the app itself.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4590,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127120':14A,17A '-2026':13A,16A '2.5.5':76C '2.6.0':108C 'advis':118C 'affect':115C 'app':33B,62B 'argument':39B,92C 'attack':47B,100C 'ausweisapp':2A,19B,26B,72C 'ausweisapp-mobil':18B 'authent':32B 'compon':84C,116C 'context':65B 'craft':52B 'cross':9A,96C 'cross-sit':8A 'cve':12A,15A,120C 'eid':23B,31B 'enabl':7A 'fail':34B 'fix':110C 'found':69C 'function':81C 'german':22B,29B 'german-eid':21B 'get':50B 'governikus':1A,24B,71C 'handl':36B 'handler':44B,86C 'impact':78C 'initi':103C 'issu':112C 'manipul':4A,89C 'messag':6A,56B 'mobil':3A,20B,25B,27B,73C 'nation':30B 'perform':87C 'remot':104C 'request':122C 'respons':43B 'result':5A,94C 'resultmessag':38B,93C 'run':58B 'safe':45B 'script':11A,59B,98C 'site':10A,97C 'startpao':42B 'startpaosrespons':85C 'unknown':80C 'upgrad':105C,113C 'valu':53B 'vendor':125C 'version':107C 'vulner':67C 'web':64B","nicknames":[],"mitigations":[],"who_affected":"Users of AusweisApp Mobile up to version 2.5.5 who authenticate with their German eID through the app. The sources do not say whether integrating services or businesses are affected beyond the app itself.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update the AusweisApp Mobile app to version 2.6.0 or later from your app store.","pkeys":[],"ptokens":[],"labels":["ausweisappmobile","germaneid","governikus","medium","mobile","other"],"campaign_type":null,"search_a":"'-127120':14A,17A '-2026':13A,16A 'ausweisapp':2A 'cross':9A 'cross-sit':8A 'cve':12A,15A 'enabl':7A 'governikus':1A 'manipul':4A 'messag':6A 'mobil':3A 'result':5A 'script':11A 'site':10A","search_b":"'app':33B,62B 'argument':39B 'attack':47B 'ausweisapp':19B,26B 'ausweisapp-mobil':18B 'authent':32B 'context':65B 'craft':52B 'eid':23B,31B 'fail':34B 'german':22B,29B 'german-eid':21B 'get':50B 'governikus':24B 'handl':36B 'handler':44B 'messag':56B 'mobil':20B,25B,27B 'nation':30B 'respons':43B 'resultmessag':38B 'run':58B 'safe':45B 'script':59B 'startpao':42B 'valu':53B 'web':64B","search_c":"'2.5.5':76C '2.6.0':108C 'advis':118C 'affect':115C 'argument':92C 'attack':100C 'ausweisapp':72C 'compon':84C,116C 'cross':96C 'cve':120C 'fix':110C 'found':69C 'function':81C 'governikus':71C 'handler':86C 'impact':78C 'initi':103C 'issu':112C 'manipul':89C 'mobil':73C 'perform':87C 'remot':104C 'request':122C 'result':94C 'resultmessag':93C 'script':98C 'site':97C 'startpaosrespons':85C 'unknown':80C 'upgrad':105C,113C 'vendor':125C 'version':107C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127120","severity":null,"published_at":"2026-11-12T20:18:34+00:00","modified_at":"2026-11-12T20:18:35+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","fetched_at":"2026-11-12T20:40:26+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}