Last Modified: Sep 10, 2026
Affected Product(s):
BIG-IP APM
Known Affected Versions:
17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.1.2, 17.1.2.1, 17.1.2.2, 17.1.3, 17.1.3.1, 17.1.3.2, 17.1.3.4, 17.1.3.5
Opened: Jun 23, 2023 Severity: 3-Major
When BIG-IP APM operates as an OAuth Authorization Server, the state parameter returned to the OAuth client may have its URL encoding removed. The returned value therefore differs from the value supplied by the client The reported client sends a Base64-encoded state value and expects the Authorization Server to return the same opaque value unchanged. Instead, APM returns a redirect Location header containing the decoded form of the state parameter
The issue applies when: - BIG-IP APM is configured as an OAuth Authorization Server - An OAuth client supplies a URL-encoded state parameter - The authorization flow returns the client through a redirect - The encoded representation of the state contains characters that are decoded during response generation
OAuth clients that compare the returned state value with the originally submitted value may reject the authorization response because the values do not match. This can cause OAuth transaction failures or prevent successful completion of the authorization flow The exact end-user impact was not populated in the available bug record
None
None