{"affected":[{"product":"AusweisApp Mobile","source":"CNA: VulDB","vendor":"Governikus","versions":[{"status":"affected","version":"2.5.0"},{"status":"affected","version":"2.5.1"},{"status":"affected","version":"2.5.2"},{"status":"affected","version":"2.5.3"},{"status":"affected","version":"2.5.4"},{"status":"affected","version":"2.5.5"},{"status":"unaffected","version":"2.6.0"}]}],"cveId":"CVE-2026-127120","cwes":["CWE-79","CWE-94"],"description":"A vulnerability was found in Governikus AusweisApp Mobile up to 2.5.5. This impacts an unknown function of the component StartPAOSResponse Handler. Performing a manipulation of the argument ResultMessage results in cross site scripting. The attack can be initiated remotely. Upgrading to version 2.6.0 will fix this issue. Upgrading the affected component is advised. This CVE was requested by the vendor.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: VulDB","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X","version":"4.0"},{"score":4.3,"severity":"medium","source":"CNA: VulDB","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C","version":"3.1"},{"score":4.3,"severity":"medium","source":"CNA: VulDB","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C","version":"3.0"},{"score":5,"severity":"medium","source":"CNA: VulDB","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C","version":"2.0"},{"score":5.3,"severity":"medium","source":"NVD: cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":4.3,"severity":"medium","source":"NVD: cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},{"score":5,"severity":"medium","source":"NVD: cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","version":"2.0"}],"modifiedAt":1794529635978,"publishedAt":1794513618060,"references":[{"source":"CNA: VulDB","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/vuln/436402"},{"source":"CNA: VulDB","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/436402/cti"},{"source":"CNA: VulDB","tags":["third-party-advisory"],"url":"https://vuldb.com/cve/CVE-2026-127120"},{"source":"CNA: VulDB","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/1033285"},{"source":"CNA: VulDB","tags":["patch"],"url":"https://www.governikus.de/loesungen/kundenprojekte/AusweisApp/"},{"source":"cna@vuldb.com","tags":[],"url":"https://vuldb.com/cve/CVE-2026-127120"},{"source":"cna@vuldb.com","tags":[],"url":"https://vuldb.com/submit/1033285"},{"source":"cna@vuldb.com","tags":[],"url":"https://vuldb.com/vuln/436402"},{"source":"cna@vuldb.com","tags":[],"url":"https://vuldb.com/vuln/436402/cti"},{"source":"cna@vuldb.com","tags":[],"url":"https://www.governikus.de/loesungen/kundenprojekte/AusweisApp/"}],"remediation":[{"kind":"fix","source":"CNA: VulDB","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.governikus.de/loesungen/kundenprojekte/AusweisApp/"}],"revision":"1b85724e2d87218601f156ddc71af14162467ffb48e8cd3723d438dc5130373e","sources":[{"modifiedAt":1794529635978,"name":"CNA: VulDB","retrievedAt":1794532161297,"url":"https://www.cve.org/CVERecord?id=CVE-2026-127120"},{"modifiedAt":1794514715047,"name":"NVD","retrievedAt":1794529638278,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127120"}],"ssvc":{"assessedAt":1794529618368,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Governikus AusweisApp Mobile StartPAOSResponse cross site scripting","updatedAt":1794532161297}