EUVD-2026-104930
GHSA-w5c9-8gc4-7q4x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious 'tz' parameter URL
-
DeliveryDeliver login link via phishing
-
ExploitVictim opens link, script reflects
-
ExecutionExecute JavaScript in portal context
-
ImpactSteal session or harvest credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to deliver a crafted link whose 'tz' query parameter on the /v5.0/webapps/pages/public/Login endpoint carries the payload, and a victim must click/open that link (UI:P) for the reflected script to execute - this user-interaction requirement is the main limiting factor. No authentication is required (PR:N) and the login page is public-facing by design, so no special server configuration is needed; impact is confined to the victim's browser session against OptimalCloud 5.0 specifically. No vendor patch is confirmed available, as the vendor did not respond to disclosure. |
| Impact | This is a reflected cross-site scripting (CWE-79) flaw in the OptimalCloud login page, and the signals point to a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) shows a network-reachable, low-complexity, unauthenticated attack, but it requires user interaction (UI:P) - the victim must open a crafted link - which is the primary brake on real-world risk. Impact is constrained: the vendor-supplied vector sets only VI:L (limited integrity impact on the vulnerable system) with no confidentiality or availability impact, consistent with script execution in the victim's browser context rather than server compromise. The CVSS 4.0 maturity flag E:P indicates proof-of-concept exploit code exists, but this is NOT the same as active exploitation. There is no CISA KEV listing and no EPSS score was provided in the input, so widespread or automated exploitation cannot be inferred. Net: a credible, low-complexity XSS worth patching in exposed deployments, but the user-interaction requirement and the vendor being an unresponsive niche IAM provider make this a lower-tier priority than its network/unauthenticated profile alone might suggest. |
| Exploit ScenarioDerived | An attacker crafts a URL to the OptimalCloud v5.0 login page with a malicious payload in the 'tz' parameter and delivers it to a target via phishing or a malicious link. When the victim opens the link, the reflected script executes in their browser in the context of the OptimalCloud domain, enabling session/credential theft or UI manipulation on the identity portal. Proof-of-concept exploit code is reported to exist (CVSS maturity E:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Reflected cross-site scripting in Optimal IdM's OptimalCloud 5.0 login endpoint (/v5.0/webapps/pages/public/Login) allows a remote, unauthenticated attacker to execute script in a victim's browser by supplying a crafted payload in the 'tz' parameter. Exploitation hinges on user interaction: the victim must click a link the attacker delivers, and impact is confined to that victim's browser session and the OptimalCloud origin (session/token theft or page defacement), not the server itself. No CISA KEV listing or confirmed active exploitation exists, the CVSS 4.0 vector records only proof-of-concept exploit maturity (E:P), and the vendor did not respond to disclosure, so no vendor-released patch was identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must be compensating until Optimal IdM publishes a fix - track the VulDB entry (https://vuldb.com/vuln/422656) for updates and escalate directly with the vendor, since the disclosure submission (https://vuldb.com/submit/991713) went unanswered. Practical controls: enforce strict output encoding of the 'tz' parameter in the login page template and validate it against an allowlist of expected IANA timezone identifiers (e.g. Region/City), rejecting anything outside that pattern - the trade-off is that legitimate free-form timezone inputs, if any exist, will break and should be normalized client-side; deploy a WAF or reverse-proxy rule that blocks script-bearing payloads in the 'tz' query string on /v5.0/webapps/pages/public/Login, accepting possible false positives on unusual parameter values; add a restrictive Content-Security-Policy (no inline script, explicit script-src allowlist) on the login origin, which mitigates execution but requires auditing existing inline scripts to avoid breaking the page; and set session cookies HttpOnly and SameSite=Lax/Strict so that even successful script execution cannot trivially exfiltrate session tokens. Because exploitation requires victim interaction, user awareness around unsolicited login links offers marginal additional reduction, but should not substitute for server-side encoding fixes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected variant: the 'tz' (timezone) query parameter of the public login page is echoed back into the HTML response without adequate output encoding or input validation, so markup supplied in the URL is rendered as script in the browser of whoever opens the link. Because the page is public and requires no authentication (the supplied vector carries PR:N), any internet user can be targeted, but the CVSS 4.0 vector's UI:P and the independent assessment's UI:R reflect that a victim must actively open the crafted URL - the primary limiting factor on real-world impact. The CPE entry cpe:2.3:a:optimal_idm:optimalcloud:*:*:*:*:*:*:*:* uses a wildcard version, meaning the CPE feed does not constrain the range, while the underlying disclosure specifically targets version 5.0; the CVSS 4.0 base of 5.3 with VC:N/VI:L (no confidentiality, low integrity, scope-unchanged per the 3.1 reassessment S:C nuance) is consistent with a client-side script-injection issue rather than server compromise.
Know when Optimalcloud gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Unauthenticated network-delivered reflected XSS needing victim click (UI:R); scope changes to the browser (S:C) with limited confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB