CVE-2026-113384: Optimal IdM OptimalCloud social redirect
A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker can remotely manipulate the state argument sent to the /v5.0/social endpoint. The CVSS vector indicates no privileges are required, but user interaction is required for exploitation.
What is the practical impact?
Successful exploitation can redirect a user to an attacker-controlled destination. The reported impact is limited to integrity; no confidentiality or availability impact is identified.
Is a vendor fix available?
The available data does not identify a fix or workaround. The vendor was contacted during disclosure but did not respond.