BugZero | F5 BugID 1429717 - APM as oAuth AS intermittently returning HTTP/1.1 ...

F5 - Defect ID: 1429717

APM as oAuth AS intermittently returning HTTP/1.1 400 Bad Request

F5 - Defect ID: 1429717

APM as oAuth AS intermittently returning HTTP/1.1 400 Bad Request

Last updated on March 11th, 2026

BugZero Risk Score
9.4 High

Overall: 9.4

Severity: 10.0

Community: 4.2

Lifecycle: 8.3

What is the BugZero Risk Score?

F5 Integration

Learn more about where this data comes from

F5 Integration

Learn more

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

Learn more

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise

Learn more

Bug Details

Priority: 1-Blocking
Status: Verified
Impact Category: Access Policy Manager
Views: 7

Description

Symptoms

BIG-IP configured as oAuth AS on a VIPRION environment intermittently, the oAuth token request (POST /f5-oauth2/v1/token) fails with 400 Bad Request. Following is an example APM logs error: "Error Code (invalid_request) Error Description (Invalid parameter (auth_code).)"

Impact

Authentication failed, unable to reach back-end resources.

Conditions

BIG-IP configured as oAuth AS.

Workaround

None

Fix Information

None

Change history

2026-03-11 Added: 15.1.10.7

2025-12-31 Added: 15.1.10.7

2025-11-15 Added: 15.1.10.7

2025-10-19 Added: 15.1.10.7

2025-07-09 Added: 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1, 15.1.10, 15.1.10.2, 15.1.10.3, 15.1.10.4, 15.1.10.5, 15.1.10.6, 16.1.0, 16.1.1, 16.1.2, 16.1.2.1, 16.1.2.2, 16.1.3, 16.1.3.1, 16.1.3.2, 16.1.3.3, 16.1.3.4, 16.1.3.5, 16.1.4, 16.1.4.1, 16.1.4.2, 16.1.4.3, 16.1.5, 16.1.5.1, 16.1.5.2, 17.0.0, 17.0.0.1, 17.0.0.2, 17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4

Relevant Products

Click on a version to see all relevant bugs

Affected versions:15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1, 15.1.10, 15.1.10.2, 15.1.10.3, 15.1.10.4, 15.1.10.5, 15.1.10.6, 15.1.10.7, 16.1.0, 16.1.1, 16.1.2, 16.1.2.1, 16.1.2.2, 16.1.3, 16.1.3.1, 16.1.3.2, 16.1.3.3, 16.1.3.4, 16.1.3.5, 16.1.4, 16.1.4.1, 16.1.4.2, 16.1.4.3, 16.1.5, 16.1.5.1, 16.1.5.2, 17.0.0, 17.0.0.1, 17.0.0.2, 17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4

Fixed versions: 17.5.0, 17.1.2, 16.1.6, 15.1.10.8

Relevant Products

Click on a version to see all relevant bugs

Affected versions:15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1, 15.1.10, 15.1.10.2, 15.1.10.3, 15.1.10.4, 15.1.10.5, 15.1.10.6, 15.1.10.7, 16.1.0, 16.1.1, 16.1.2, 16.1.2.1, 16.1.2.2, 16.1.3, 16.1.3.1, 16.1.3.2, 16.1.3.3, 16.1.3.4, 16.1.3.5, 16.1.4, 16.1.4.1, 16.1.4.2, 16.1.4.3, 16.1.5, 16.1.5.1, 16.1.5.2, 17.0.0, 17.0.0.1, 17.0.0.2, 17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4

Fixed versions: 17.5.0, 17.1.2, 16.1.6, 15.1.10.8

Top F5 Defects

9.4Defect ID: 970269
Install fails as lind keeps failing due to "Fatal error: block id new probe failed - device file:/dev/cdrom"
9.4Defect ID: 1032405
TMUI XSS vulnerability CVE-2021-23037
9.4Defect ID: 1429717
APM as oAuth AS intermittently returning HTTP/1.1 400 Bad Request
9.4Defect ID: 2141205
Tpm-status returns: "System Integrity: Invalid" for some Engineering Hotfixes
9.3Defect ID: 1505789
VPN connection fails with Edge client 7.2.4.6 with error "Network is vulnerable"

Ready to prevent the next vendor outage?

Get a demo

Links

Original Vendor Announcement

F5 Integration

Learn more about where this data comes from

F5 Integration

Learn more

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

Learn more

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise

Learn more

F5 - Defect ID: 1429717

APM as oAuth AS intermittently returning HTTP/1.1 400 Bad Request

F5 - Defect ID: 1429717

APM as oAuth AS intermittently returning HTTP/1.1 400 Bad Request

Last updated on March 11th, 2026

BugZero Risk Score9.4 High

Bug Details

Symptoms

Impact

Conditions

Workaround

Fix Information

Top F5 Defects

Ready to prevent the next vendor outage?

Links

BugZero Risk Score
9.4 High