Optimalcloud
Monthly
Open redirect in Optimal IdM OptimalCloud 5.0 lets unauthenticated remote attackers craft a /v5.0/social link with an attacker-controlled state parameter, causing a victim who clicks it to be redirected to an arbitrary external site after social-login/OAuth callback handling. Exploitation requires user interaction and yields only integrity-low impact, with no confidentiality or availability effect. Publicly available exploit code exists per the CVSS v4 E:P proof-of-concept metric, but no CISA KEV entry confirms active exploitation and no EPSS score was provided.
Reflected cross-site scripting in Optimal IdM's OptimalCloud 5.0 login endpoint (/v5.0/webapps/pages/public/Login) allows a remote, unauthenticated attacker to execute script in a victim's browser by supplying a crafted payload in the 'tz' parameter. Exploitation hinges on user interaction: the victim must click a link the attacker delivers, and impact is confined to that victim's browser session and the OptimalCloud origin (session/token theft or page defacement), not the server itself. No CISA KEV listing or confirmed active exploitation exists, the CVSS 4.0 vector records only proof-of-concept exploit maturity (E:P), and the vendor did not respond to disclosure, so no vendor-released patch was identified at time of analysis.
Open redirect in Optimal IdM OptimalCloud 5.0 lets unauthenticated remote attackers craft a /v5.0/social link with an attacker-controlled state parameter, causing a victim who clicks it to be redirected to an arbitrary external site after social-login/OAuth callback handling. Exploitation requires user interaction and yields only integrity-low impact, with no confidentiality or availability effect. Publicly available exploit code exists per the CVSS v4 E:P proof-of-concept metric, but no CISA KEV entry confirms active exploitation and no EPSS score was provided.
Reflected cross-site scripting in Optimal IdM's OptimalCloud 5.0 login endpoint (/v5.0/webapps/pages/public/Login) allows a remote, unauthenticated attacker to execute script in a victim's browser by supplying a crafted payload in the 'tz' parameter. Exploitation hinges on user interaction: the victim must click a link the attacker delivers, and impact is confined to that victim's browser session and the OptimalCloud origin (session/token theft or page defacement), not the server itself. No CISA KEV listing or confirmed active exploitation exists, the CVSS 4.0 vector records only proof-of-concept exploit maturity (E:P), and the vendor did not respond to disclosure, so no vendor-released patch was identified at time of analysis.