{"id":"CVE-2026-113383","kind":"vulnerability","aliases":["CVE-2026-113383"],"related":[],"title":"Optimal IdM OptimalCloud: login page tz parameter enables cross-site scripting","description":"A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"OptimalCloud 5.0 has a cross-site scripting flaw in the tz argument of the public Login page at /v5.0/webapps/pages/public/Login. An attacker who gets a user to open a crafted link can run script in that user's browser session.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["optimal-idm","optimalcloud","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T11:17:20+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:30:45+00:00","updated_at":"2026-10-25T04:30:45+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:30:45Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Optimal IdM OptimalCloud: login page tz parameter enables cross-site scripting","impact":"medium","summary":"OptimalCloud 5.0 has a cross-site scripting flaw in the tz argument of the public Login page at /v5.0/webapps/pages/public/Login. An attacker who gets a user to open a crafted link can run script in that user's browser session.","category":"vendor","nicknames":[],"who_cares":["optimalcloud","optimal-idm","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Script runs in victim's browser on the login page","analyst_note":"Vendor did not respond; find whether any patched OptimalCloud release or workaround exists, and confirm which versions are affected.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000513,"input_tokens":3328,"output_tokens":360,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113383':15A,18A '-2026':14A,17A '/v5.0/webapps/pages/public/login':46B,84C '5.0':28B,75C 'affect':77C 'argument':39B,90C 'attack':48B,101C 'browser':65B 'contact':107C 'craft':56B 'cross':10A,32B,94C 'cross-sit':9A,31B 'cve':13A,16A 'detect':70C 'disclosur':111C 'earli':108C 'enabl':8A 'exploit':98C 'file':83C 'flaw':35B 'get':50B 'host':25B 'idm':2A,21B,73C 'link':57B 'login':4A,43B 'manipul':87C 'open':54B 'optim':1A,20B,72C 'optimal-idm':19B 'optimalcloud':3A,22B,27B,74C 'page':5A,44B 'paramet':7A 'part':80C 'perform':85C 'possibl':103C 'public':42B 'remot':97C 'respond':115C 'result':92C 'run':59B 'script':12A,34B,60B,96C 'self':24B 'self-host':23B 'session':66B 'site':11A,33B,95C 'tz':6A,38B,91C 'unknown':79C 'user':52B,63B 'vendor':26B,105C 'vulner':68C 'way':118C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113383","severity":null,"published_at":"2026-10-20T11:17:20+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}