CVE-2021-22506 is an information leakage vulnerability in Micro Focus Micro Focus Access Manager. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.
What this vulnerability means in an access management product
An information leakage flaw in an access management platform is dangerous because the product sits on a trust boundary: it brokers sign-in, assertions, redirects and session handoff. When that boundary leaks data, attackers may learn details that should remain hidden, such as internal URLs, routing behaviour, or transaction context that helps them plan follow-on abuse.
In this case, the issue is tied to SAML service provider redirection when the Assertion Consumer Service URL is used. That makes the problem especially sensitive in environments that rely on federation, because a subtle redirect weakness can expose information during the authentication flow even when the application itself appears otherwise intact.
For the broader vulnerability record and authoritative tracking, readers should use the CVE Program entry format and the NIST National Vulnerability Database rather than relying on summary descriptions alone.
Why leaked information matters during federated sign-in
Information leakage is not always a full compromise on its own, but in authentication systems it can materially lower the cost of attack. Small disclosures can reveal how requests are validated, where users are redirected, how assertions are handled, or which integration paths exist, all of which can help an attacker shape phishing, replay, or misdirection attempts.
In federated identity flows, that matters because the attacker is not just probing a web page, they are probing the trust fabric between an identity provider, service provider and user session. If that fabric leaks enough operational detail, the attacker may be able to move from passive observation to targeted abuse of the federation path.
- Exposed routing or endpoint details can aid targeted exploitation of the authentication workflow.
- Disclosure around assertion handling can support phishing, redirect abuse or session-focused follow-on attacks.
- In a federated stack, one weak trust edge can create risk across multiple connected applications.
How organisations check exposure and confirm impact
Exposure checks should begin with asset inventory: identify every deployment of the affected access management product, every internet-facing instance, and every environment that uses the vulnerable SAML flow. A product may be present in production, staging or partner-facing infrastructure, and all three can matter if the same federation path is reachable.
Then compare the deployed system against the vendor advisory and the CISA KEV catalogue, because KEV inclusion means the issue has been used in real-world attacks and should be treated as operationally urgent. That pairing, vendor guidance plus KEV status, is the fastest way to separate theoretical exposure from likely exploitation risk.
When reviewing impact, look for unusual redirects, changes in SAML transaction behaviour, unexpected access logs, or evidence that the leaked information was used to stage further compromise. If the system brokers access for sensitive applications, also review whether downstream relying parties could have inherited the same exposure window.
Remediation, detection, and post-incident review
The preferred response is to apply the vendor fix as soon as it is available, but organisations often need compensating controls while change windows are being prepared. Reduce internet exposure where possible, restrict administrative reach, tighten monitoring around federation endpoints, and review whether any temporary routing or reverse-proxy changes can lower risk without breaking sign-in.
Detection should focus on the federation path itself, not just generic web traffic. Watch for suspicious ACS-related requests, unusual redirect patterns, repeated probing of the login flow, and access attempts that follow a leak-driven reconnaissance pattern rather than normal user behaviour.
After remediation, perform a short compromise review even if the issue is described as information leakage rather than code execution. If exploitation is suspected, reassess related sessions, federation trust settings, and any credentials or tokens that may have been exposed indirectly through the affected access path.
Risk and Threat Considerations
This type of flaw matters most when the access management server is internet reachable and used as a front door to many applications. Even a narrow information leak can give an attacker enough structure to refine phishing, enumeration or redirect abuse against a high-value federation service.
Failure mechanism: The vulnerable SAML redirection logic can disclose information during assertion consumer handling, giving an attacker insight into trust flows, endpoints or request handling that should remain hidden.
Impact: That disclosure can enable more precise exploitation of the sign-in path, support downstream compromise attempts, and increase the chance that a seemingly small leak becomes a wider identity or application security incident.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Federated access depends on strong user authentication at the access boundary. |
| IA-5 — Authenticator Management | Exploitation may expose or undermine credentials, sessions or authenticators tied to access flows. | |
| AC-17 — Remote Access | Internet-facing access gateways and federation portals are remote access choke points. | |
| Recommendation — Strengthen organizational user authentication on federation entry points and review trust path exposure. Rotate and manage authenticators and related secrets after suspected leakage or compromise. Restrict and monitor remote access paths that expose federation and sign-in services. | ||
| OWASP ASVS | V10 — OAuth and OIDC | Federated sign-in flows share similar token and redirect trust concerns with identity protocols. |
| Recommendation — Validate federation redirect handling and trust assumptions in identity protocol implementations. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Access gateway exposure is reduced by controlling and reviewing who can reach administrative and federation services. |
| Recommendation — Limit access to identity infrastructure and remove unnecessary exposure to authentication services. | ||
Practitioner Guidance
Why practitioners should care: Treat access management vulnerabilities as infrastructure-level security events, not ordinary application bugs, because they sit at the point where identity traffic becomes application access. A small flaw here can have outsized blast radius across connected services.
What to watch for: Prioritise any instance that is externally reachable, federated into multiple apps, or already used by privileged users. Those deployments deserve the fastest validation, because the exposure is both broader and more attractive to attackers.
Practitioner takeaway: For federated identity products, remediation priority should follow trust impact, not just the size of the disclosed detail.