CVE-2026-113383: Cross Site Scripting in Optimal IdM OptimalCloud

This vulnerability affects Optimal IdM OptimalCloud version 5.0. It is caused by improper handling of the 'tz' argument in the login page, allowing an attacker to inject malicious scripts via cross-site scripting (XSS). The vulnerability can be exploited remotely without authentication. The vendor was contacted but did not provide any response or patch information.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS 4.0 base score is 5.3 (medium severity), indicating moderate impact with no privileges required and no user interaction needed, but limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'tz' parameter as a temporary mitigation.