Radware Alteon has a reflected Cross-Site Scripting vulnerability in version 34.5.4.0. This flaw exists in the ReturnTo parameter of the /protected/login route. The vulnerability stems from a failure to properly sanitize user input. Attackers can exploit this by injecting malicious JavaScript into the ReturnTo parameter. When a user is redirected to a SAML login page, the load balancer reflects the unsanitized parameter. This reflected payload then executes in the victim's browser. The exploit allows attackers to steal sensitive data, perform unauthorized actions, and conduct phishing attacks. It can also damage the reputation of the affected website. Radware has acknowledged the vulnerability and plans a fix in version 34.5.7.0. Users should validate and encode input until a patch is applied.