OptimalCloud EUVD-2026-104931

Exploitation targets the 'state' argument of the /v5.0/social endpoint (social-login/OAuth callback handling) in Optimal IdM OptimalCloud 5.0; the attacker supplies an attacker-controlled destination in that parameter. The key limiting factor is required user interaction (UI:P in the CVSS vector): a victim must actually open the attacker-crafted link, so there is no server-side compromise and no impact without a human clicking through. No authentication is required to craft the link (PR:N), but impact is confined to redirection (integrity-low), with no confidentiality or availability effect.

This is a low-severity, low-priority issue despite being remotely reachable. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) scores only 2.1 and correctly reflects an open redirect (CWE-601): network-reachable and unauthenticated, but requiring user interaction (UI:P - the victim must follow a crafted link) and yielding only low integrity impact with no confidentiality or availability impact. The CVSS threat metric E:P (Proof-of-Concept) suggests a PoC-level exploit maturity, but no separate POC flag, exploit URL, or KEV listing is present in the input, so active exploitation is not confirmed. No EPSS score was provided. These signals are internally consistent: a classic open redirect used primarily to lend legitimacy to phishing, not a direct system-compromise vector. The only sourcing is VulDB (a single aggregator); the vendor was contacted but did not respond, so affected-version and fix data are unconfirmed. Net: real but minor - appropriate to patch during routine maintenance rather than emergency response.

An attacker crafts a URL to /v5.0/social with a manipulated 'state' parameter pointing to an attacker-controlled domain, then delivers it via phishing email or malicious link. A victim who trusts the OptimalCloud domain clicks the link, authenticates or interacts, and is silently redirected to the attacker's site for credential harvesting or malware delivery. CVSS threat maturity E:P indicates proof-of-concept-level knowledge exists, but no confirmed public exploit code is referenced.