Description
A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-20
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: cross‑site scripting that allows a remote attacker to inject malicious script into a victim’s browser, potentially compromising session credentials or defacing the site
Action: Apply Patch
AI Analysis

Impact

A reflected cross‑site scripting flaw is triggered by manipulating the 'tz' parameter on the /v5.0/webapps/pages/public/Login endpoint. The injected script is rendered in the browser without needed authentication, enabling a remote attacker to steal cookies, hijack sessions, or deface the interface. The vulnerability is classified as CWE‑79 (XSS) and involves improper handling of user input that could also allow code injection, aligning with CWE‑94.

Affected Systems

The affected product is Optimal IdM:OptimalCloud version 5.0. The flaw resides in an unknown fragment of the login page located at /v5.0/webapps/pages/public/Login within the Optimal IdM:OptimalCloud web application.

Risk and Exploitability

The CVSS score of 5.3 places the issue in the moderate range. EPSS data is not available and the vulnerability is not listed in CISA KEV, indicating limited current exploitation. Remote exploitation is possible by crafting a URL that includes a malicious 'tz' value; a victim who navigates to that URL will have the injected script executed in their browser. The risk is moderate but real for any organization using the exposed login endpoint.

Generated by OpenCVE AI on October 20, 2026 at 15:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest patch or upgrade to the newest Optimal IdM:OptimalCloud release that addresses the CWE‑79 XSS flaw in the login page.
  • If a patch is unavailable, add strict validation to the tz parameter so that only expected values are accepted, and escape or encode any content before rendering, which mitigates both CWE‑79 and guards against CWE‑94 code‑inject attacks.
  • Deploy a Content Security Policy that restricts script execution to trusted origins and set the Secure and HttpOnly flags on session cookies to reduce the impact of any residual script injection.

Generated by OpenCVE AI on October 20, 2026 at 15:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Title Optimal IdM OptimalCloud Login cross site scripting
First Time appeared Optimal Idm
Optimal Idm optimalcloud
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:optimal_idm:optimalcloud:*:*:*:*:*:*:*:*
Vendors & Products Optimal Idm
Optimal Idm optimalcloud
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Optimal Idm Optimalcloud
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-20T13:42:01.165Z

Reserved: 2026-10-20T04:40:44.790Z

Link: CVE-2026-113383

cve-icon Vulnrichment

Updated: 2026-10-20T13:41:53.377Z

cve-icon NVD

Status : Received

Published: 2026-10-20T11:17:20.780

Modified: 2026-10-20T14:16:58.553

Link: CVE-2026-113383

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T15:45:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')