Last Modified: Sep 30, 2026
Affected Product(s):
BIG-IP APM
Fixed In:
21.1.0
Opened: Jan 29, 2026 Severity: 3-Major
When APM uses NTLM SSO to a backend application, the backend first returns 401 Unauthorized with WWW-Authenticate: NTLM and a Set-Cookie for JSESSIONID. After NTLM completes, APM sends a 200 OK to the client but does not include the JSESSIONID cookie. The client does not receive the backend session cookie. Packet captures show the backend sent the JSESSIONID during the NTLM challenge, but APM did not pass this cookie in the final 200 OK.
Applications that rely on the backend JSESSIONID may not establish or maintain sessions, leading to repeated authentication prompts, errors, or unexpected redirects after NTLM login.
Occurs when, - APM is configured for NTLM SSO to a backend application. - The backend issues a session cookie (e.g., JSESSIONID) during the NTLM handshake. - The client depends on that session cookie to maintain application state. - APM terminates the client connection and proxies authentication to the backend.
N/A
N/A