Radware Alteon 34.5.4.0 vADC load-balancer contains a reflected XSS vulnerability in the…
Radware Alteon 34.5.4.0 vADC load-balancer contains a reflected XSS vulnerability in the /protected/login route's ReturnTo parameter enabling arbitrary JavaScript execution.
A reflected Cross-Site Scripting (XSS) vulnerability (CVE-2026-5754) affects Radware Alteon version 34.5.4.0 vADC load-balancer. The vulnerability exists in the ReturnTo parameter of the /protected/login route, where insufficient input sanitization allows attackers to inject malicious scripts. When users request resources that redirect to Microsoft SAML login pages, the load-balancer fails to sanitize the ReturnTo parameter, enabling payload injection that executes in victim browsers.
The attack chain is straightforward: an attacker crafts a malicious link containing XSS payload in the ReturnTo parameter, the victim clicks the link and is redirected to the login page, and the load-balancer reflects the malicious parameter back, triggering JavaScript execution. This enables session cookie theft, unauthorized actions on behalf of victims, phishing attacks, and damage to organizational reputation.
Radware has acknowledged the vulnerability in their customer portal and indicated a patch would be included in version 34.5.7.0, expected March 31, 2026, though release confirmation is unclear. CERT/CC was unable to reach the vendor for coordination. Organizations should implement input validation and encoding controls as interim mitigations.
Mentioned in this report
Detection guidance
Potential Cookie Exfiltration via JavaScript document.cookie in Outbound Web Request
Detects outbound HTTP requests where the query string or referrer contains document.cookie or encoded cookie values, indicating a successful XSS payload attempting to exfiltrate session cookies to an attacker-controlled endpoint. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential Cookie Exfiltration via JavaScript document.cookie in Outbound Web
Request
id: 7a4ad69a-48fa-5244-ad1a-b0ce2ae73a66
status: experimental
description: Detects outbound HTTP/S requests carrying document.cookie references
or base64/URL-encoded cookie-like data in the URI or referrer header, which is a
common pattern for exfiltrating stolen session cookies following successful reflected
XSS exploitation such as CVE-2026-5754.
references:
- CVE-2026-5754
author: Vorant
logsource:
category: proxy
detection:
selection_cookie_ref:
c-uri|contains:
- document.cookie
- SameSite
- /cookie=
selection_referrer:
referrer|contains: /protected/login
condition: selection_cookie_ref and selection_referrer
falsepositives:
- Legitimate web applications passing cookie values in debugging or telemetry parameters
- Third-party analytics or session management scripts that legitimately reference
document.cookie in URLs
level: medium
tags:
- attack.t1539
- attack.t1059.007
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/890999
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free