CVE-2026-90848 — Cross-site scripting in Governikus AusweisApp StartPAOSResponse

A weakness affects Governikus AusweisApp up to version 2.5.4 in the StartPAOSResponse Handler component. Manipulation of the ResultMessage argument can lead to cross-site scripting (XSS). The attack can be launched remotely.