The weakness corresponds to CWE-601: Open Redirect. The flaw located in the /v5.0/social endpoint allows remote attackers to manipulate the 'state' parameter, causing the application to redirect users to arbitrary URLs. This open redirect can be exploited to deliver phishing attacks, bypass client-side security checks, or facilitate malware distribution. The vulnerability does not provide direct code execution or credential theft but enables social engineering vectors.

Optimal IdM:OptimalCloud version 5.0 are the affected products. The vulnerability originates from unknown code within the /v5.0/social resource of this version. No other versions or products are listed as vulnerable.

The CVSS score of 5.3 classifies it as a medium‑severity vulnerability. The EPSS score is not available, but the lack of a KEV listing suggests it is not a widely exploited issue yet. A remote attacker could trigger the flaw simply by sending a crafted request to the social redirect endpoint. Since the exploit requires only manipulation of a query parameter, the attack can be performed from any network with access to the web application. The open‑redirect nature may be used in phishing or credential‑harvesting campaigns.