And when trying to log into the system... it also returns a 500 Internal Server Error.
...We suspect that one or more server-side updates deployed shortly before 6 September may have triggered the current authentication failure. Fresh TomTom sign-in requests are reaching the backend but are returning HTTP 500, so we recommend reviewing infrastructure and package changes made during 3–6 September.
Possible triggers:
Linux kernel security updates released on 4 September. If these were installed on TomTom nodes, they may have caused reboots, node replacement, pod rescheduling or restarted services with different runtime state. Ubuntu published new kernel security updates on 4 September.
OpenSSH update released on 3 September. This is unlikely to break OAuth directly, but if deployment, secrets distribution or administrative automation depends on SSH, the update could have affected provisioning or restart procedures.
libssh2 update released on 3 September. If internal automation, SFTP-based configuration delivery or deployment tooling uses libssh2, this is worth correlating with the incident start time.
rabbitmq-c security update released on 3 September. This is particularly interesting if authentication, entitlement or account services communicate through RabbitMQ. A package/library restart, TLS change or connection incompatibility could cause downstream failures that surface externally as HTTP 500.
APR-util update released on 3 September. If any Apache-based gateway, reverse proxy or service component depends on APR/APR-util, this should be checked against recent package upgrades and service restarts.
Automatic unattended-upgrades followed by reboot. Even if the updated package itself is not the direct cause, a reboot can expose a latent problem: a Secret is no longer mounted, an environment variable is missing, a certificate is not reloaded correctly, a DNS dependency changes, or an old working pod is replaced by a new misconfigured one.
Kubernetes node or container-image rollout. Check whether nodes were drained, replaced or rebooted, whether pods were recreated, and whether a new image digest became active around the time the failures started.
Secret or OAuth signing-key rotation. This remains one of the strongest candidates. A newly rotated JWT signing key, KMS key, client secret or certificate could prevent creation of new authentication tokens while already authenticated users continue to work temporarily.
Certificate or CA trust-store update. The public endpoint is reachable, but an internal call from the authentication service to another TomTom service may now fail TLS validation because of a changed certificate, CA chain, trust store or mTLS policy.
Redis/session-store update or restart. If new sessions are stored in Redis and Redis was upgraded, restarted, failed over, or had its credentials/certificate rotated, fresh login could fail while existing cached sessions remain usable.
Database update or schema migration. A new authentication service version combined with an incomplete database migration could easily produce HTTP 500 specifically during account authentication.
API gateway / ingress update. Check recent changes to routing, headers, body handling, WAF rules, service mesh, upstream configuration and timeouts.
Identity-provider or entitlement-service deployment. The /oauth2/authenticate endpoint may itself be healthy but failing when calling an internal account, entitlement, KMS or identity service.
We propose checking, in this order:
1. Correlate the first HTTP 500 timestamp with every deployment, reboot, package upgrade, secret rotation and certificate change from 3–6 September.
2. Inspect the actual backend exception behind POST /api/v3/oauth2/authenticate -> HTTP 500.
3. Compare currently running pods and image digests with the last known-good version.
4. Verify OAuth/JWT signing keys, KMS/HSM access, client secrets and certificate rotations.
5. Check Redis, databases, RabbitMQ and internal identity/entitlement dependencies.
6. Review Kubernetes events, node reboots and unattended-upgrade logs.
7. If the incident correlates with a recent rollout, temporarily roll back to the last known-good server configuration/image.
8. Test separately:
existing authenticated session;
refresh-token flow;
completely fresh username/password login;
clean installation with no cached token.
The most suspicious pattern is still:
server/security update or restart → pods recreated → new secret/configuration/certificate state becomes active → fresh OAuth token issuance fails → HTTP 500.