---
id: "CVE-2026-127120"
page: "https://infrastack.ai/live/CVE-2026-127120"
kind: "vulnerability"
aliases: ["CVE-2026-127120"]
title: "Governikus AusweisApp Mobile: manipulated result message enables cross-site scripting"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ausweisapp-mobile", "german-eid", "governikus", "mobile", "other"]
not_affected_if: ["version-2.6.0-or-later"]
published_at: "2026-11-12T20:18:34+00:00"
first_seen_at: "2026-11-12T20:40:26+00:00"
updated_at: "2026-11-12T20:42:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127120", "first_seen_at": "2026-11-12T20:40:26+00:00"}]
exploit_sources: []
---

# Governikus AusweisApp Mobile: manipulated result message enables cross-site scripting

Link for people: https://infrastack.ai/live/CVE-2026-127120 (this .md is for agents)

AusweisApp Mobile, the German national eID authentication app, fails to handle the ResultMessage argument in its StartPAOS response handler safely. An attacker who can get a crafted value into that message can run scripts in the app's web context.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AusweisApp Mobile version in the app's about screen or store listing; versions up to `2.5.5` are affected.

## Fix

- AusweisApp Mobile: upgrade to `2.6.0`

## Timeline

- 2026-11-12T20:40:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127120

## From the sources

A vulnerability was found in Governikus AusweisApp Mobile up to 2.5.5. This impacts an unknown function of the component StartPAOSResponse Handler. Performing a manipulation of the argument ResultMessage results in cross site scripting. The attack can be initiated remotely. Upgrading to version 2.6.0 will fix this issue. Upgrading the affected component is advised. This CVE was requested by the vendor.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_