Last Modified: Sep 29, 2026
Affected Product(s):
BIG-IP APM
Known Affected Versions:
17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 17.5.1.8, 17.5.1.9
Opened: Feb 17, 2026 Severity: 2-Critical
When an API protection profile uses OAuth to process or verify JWT tokens, TMM may terminate unexpectedly and generate a core file. The following messages may be logged: Access encountered error: ERR_NOT_FOUND OAuth Scope: failed ... Internal error during signature verification didn't find agent AccessV2 agent execution error 5 The issue may also result in API protection requests failing during JWT signature verification
Traffic is disrupted while tmm restarts. This can cause API protection authentication or authorization failures. Repeated occurrences may result in service disruption
- BIG-IP APM is configured with an API protection profile - OAuth is used for JWT processing or verification - A crypto request remains in flight while the associated OAuth crypto context is replaced or released
None
None