CVE-2026-113383: Optimal IdM OptimalCloud Login cross site scripting

Published Oct 20, 2026

Updated

A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

Optimal IdM OptimalCloud=5.0

Event History

Oct 20, 2026

CVE Published

via MITRE·10:45 AM

Data Sourced

via MITRE·10:45 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Event

via NVD·12:10 PM

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker can exploit the issue remotely by manipulating the tz argument sent to the public Login page. No authentication or privileges are required, but the CVSS vector indicates user interaction is required.

Which deployments are known to be affected?

The affected product is Optimal IdM OptimalCloud version 5.0. The vulnerable component is identified as an unknown part of /v5.0/webapps/pages/public/Login.

Is a vendor fix available?

The provided information does not identify a patch or workaround. It states that the vendor was contacted early about the disclosure but did not respond.