Last Modified: Oct 10, 2026
Affected Product(s):
BIG-IP APM
Known Affected Versions:
17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 17.5.1.8, 17.5.1.9
Opened: Aug 20, 2026 Severity: 3-Major
When BIG-IP APM is set up as both an OAuth Client and an OAuth Resource Server, it utilizes an OAuth Client agent followed by an OAuth Scope agent within a per-request policy subroutine. In this configuration, SSO passthrough is also enabled. As a result, the OAuth Scope may validate a bearer token from the current request instead of the valid access token that was obtained by the OAuth Client after the subroutine's subsession has expired
This can result in a JWK mismatch and a blocking page when the request contains an unrelated application JWT
BIG-IP APM is configured as both an OAuth Client and OAuth Resource Server, with an OAuth Client agent followed by an OAuth Scope agent in a per-request policy subroutine. A Bearer token is sent via the Authorization header
None
None