CVE-2026-90848: Governikus AusweisApp XSS Vulnerability

CVE-2026-90848 Overview

CVE-2026-90848 is a cross-site scripting (XSS) vulnerability affecting Governikus AusweisApp versions up to and including 2.5.4. The flaw resides in the StartPAOSResponse Handler component, where the ResultMessage argument is not properly sanitized before being rendered. An attacker can manipulate this argument to inject script content that executes in the context of the application. The attack can be launched remotely, though it requires user interaction to succeed. Governikus addressed the issue in version 2.5.5 and the CVE was requested by the vendor. The weakness is classified under CWE-79.

Critical Impact
Remote attackers can inject arbitrary script content through the ResultMessage parameter, potentially compromising the integrity of data rendered by the AusweisApp client during electronic identification workflows.

Affected Products

Governikus AusweisApp versions up to 2.5.4
StartPAOSResponse Handler component processing the ResultMessage argument
Fixed in Governikus AusweisApp version 2.5.5

Discovery Timeline

2026-09-15 - CVE-2026-90848 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90848

Vulnerability Analysis

The vulnerability exists in the StartPAOSResponse Handler of the Governikus AusweisApp. AusweisApp is the official German client application used to authenticate with the electronic identity card (eID) function of the national ID card. The handler processes PAOS (Reverse SOAP) responses returned from eID servers during authentication flows. The ResultMessage argument within these responses is passed through the handler without sufficient output encoding or input sanitization, allowing script content to be interpreted rather than treated as data.

Because AusweisApp mediates a security-sensitive authentication protocol, any injection into rendered content undermines the trust boundary between the eID service and the client. Successful exploitation requires user interaction, which limits mass exploitation but does not prevent targeted abuse in phishing or malicious relying-party scenarios. The EPSS score is 0.263% at the 18th percentile, reflecting a low probability of observed exploitation activity.

Root Cause

The root cause is improper neutralization of input during web page generation, categorized as [CWE-79]. The StartPAOSResponse Handler accepts the ResultMessage field and incorporates it into rendered output without escaping HTML metacharacters. This allows attacker-controlled markup or script content to be treated as executable content by the rendering component.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker must induce a victim to initiate an AusweisApp session that connects to an attacker-controlled or attacker-influenced endpoint capable of returning a crafted StartPAOSResponse message. When the client processes the response, the malicious ResultMessage payload triggers script execution in the client's rendering context. No prior authentication or elevated privileges are required to launch the attack against a vulnerable client.

No verified proof-of-concept code is publicly referenced for CVE-2026-90848. Technical details are tracked in the VulDB entry for CVE-2026-90848 and VulDB Vulnerability #403403.

Detection Methods for CVE-2026-90848

Indicators of Compromise

PAOS response traffic to AusweisApp clients containing HTML or JavaScript metacharacters (<script>, onerror=, javascript:) within the ResultMessage element.
Unexpected outbound connections from AusweisApp installations to non-official eID service endpoints.
Presence of AusweisApp binaries reporting a version at or below 2.5.4 on managed endpoints.

Detection Strategies

Inventory endpoints for AusweisApp installations and flag any instance with a version string less than 2.5.5.
Inspect network telemetry for PAOS/SOAP responses returned to AusweisApp processes and alert on ResultMessage payloads that contain script tags or event-handler attributes.
Correlate AusweisApp process activity with outbound connections to domains that are not on the approved list of German eID service providers.

Monitoring Recommendations

Enable process and network telemetry on workstations that run AusweisApp, capturing parent-child process relationships and outbound TLS destinations.
Log and review any spawning of external browsers or handlers by AusweisApp following an authentication attempt.
Track AusweisApp version drift across the fleet on a recurring schedule to identify machines that have not received the 2.5.5 update.

How to Mitigate CVE-2026-90848

Immediate Actions Required

Upgrade all Governikus AusweisApp installations to version 2.5.5 or later.
Advise users to only initiate eID authentication flows with trusted relying parties and official service providers.
Restrict AusweisApp usage on shared or high-risk workstations until the patched version is deployed.

Patch Information

Governikus released version 2.5.5 of AusweisApp to remediate CVE-2026-90848. The fix addresses the improper handling of the ResultMessage argument in the StartPAOSResponse Handler. Refer to the Governikus AusweisApp project page for official download and release information.

Workarounds

No official workaround has been published; upgrading to version 2.5.5 is the recommended remediation.
As an interim measure, block AusweisApp network egress to any host outside the approved list of eID service providers.
Educate users to abort authentication sessions when unexpected prompts or content appear during an eID flow.

bash

# Example: verify installed AusweisApp version on Windows via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "AusweisApp*" } |
  Select-Object DisplayName, DisplayVersion

# Example: verify installed AusweisApp version on Linux
dpkg -l | grep -i ausweisapp