CVE-2026-113384: Open Redirect in Optimal IdM OptimalCloud

An open redirect vulnerability has been identified in Optimal IdM OptimalCloud 5.0 affecting the /v5.0/social endpoint. By manipulating the 'state' parameter, an attacker can cause the application to redirect users to arbitrary external URLs. This vulnerability is remotely exploitable without privileges or user interaction beyond clicking a crafted link. The vendor was contacted but did not provide any response or remediation information.

Successful exploitation allows an attacker to redirect users to potentially malicious websites, which can facilitate phishing attacks or other social engineering tactics. There is no indication of direct code execution or data compromise from this vulnerability alone. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, but requiring user interaction and limited impact on confidentiality and integrity.

No official fix or patch is currently available, and the vendor has not responded to the disclosure. Users and administrators should be cautious with URLs involving the /v5.0/social endpoint and avoid clicking untrusted links that include manipulated 'state' parameters. Monitor vendor channels for any future advisories or patches addressing this issue.