---
id: "CVE-2026-113383"
kind: "vulnerability"
aliases: ["CVE-2026-113383"]
title: "Optimal IdM OptimalCloud: login page tz parameter enables cross-site scripting"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["optimal-idm", "optimalcloud", "self-hosted", "vendor"]
not_affected_if: []
published_at: "2026-10-20T11:17:20+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:30:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113383", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Optimal IdM OptimalCloud: login page tz parameter enables cross-site scripting

OptimalCloud 5.0 has a cross-site scripting flaw in the tz argument of the public Login page at /v5.0/webapps/pages/public/Login. An attacker who gets a user to open a crafted link can run script in that user's browser session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113383

## From the sources

A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_