Last Modified: Oct 12, 2026
Affected Product(s):
BIG-IP APM
Known Affected Versions:
17.5.1.9
Opened: Sep 08, 2026 Severity: 3-Major
HTTP AAA form-based authentication requests are rejected if the configuration of the AAA server's Hidden Form Parameters contains multiple fields. When this happens, APM logs the following error and the login attempt fails: "HttpAgent: CR/LF detected in formParams after session variable interpolation - rejecting request."
All authentication attempts using the affected HTTP AAA form-based configuration fail, preventing user login. The failure is entirely reproducible for any request that employs a multi-field Hidden Form Parameters configuration, with no instances of partial or intermittent success
An Access Policy employs an HTTP AAA agent utilizing Form-Based authentication. The AAA server object's Hidden Form Parameters field is set up with two or more name/value pairs, each on a separate line
None
None