topic Re: Failed logins from 127.0.0.1 in VM-Series in the Public Cloud

Failed logins from 127.0.0.1

JasonHensley-Tavoca — Fri, 19 Sep 2025 13:41:15 GMT

Hello all. In my VM logs, I'm seeing a failed login like this every 5 seconds:

Authorization failed for user admin via Web from 127.0.0.1 : user admin role is not defined.

This is a single VM-100 implementation, no Panorama. Any help on where this might be coming from?

Edit to add: Currently running PANOS 11.2.8. In looking at release notes, it's possible that reverting to 11.2.7 or up to 11.2.9 may fix this issue. I'll do that and post back with results.

Re: Failed logins from 127.0.0.1

JasonHensley-Tavoca — Thu, 25 Sep 2025 04:40:50 GMT

Update: upgrading to 11.2.9 did not fix this issue. Anyone have thoughts?

Re: Failed logins from 127.0.0.1

LukeRath — Mon, 01 Dec 2025 10:32:51 GMT

I have same issue running 11.1.12.

'Authorization failed for user admin via Web from 127.0.0.1 : Invalid user'

Re: Failed logins from 127.0.0.1

PavelK — Thu, 11 Dec 2025 04:33:21 GMT

Hello @LukeRath

I am wondering whether that login could come from plugin. Do you have any plugin installed?

Kind Regards

Pavel

Re: Failed logins from 127.0.0.1

PaulCourtois — Mon, 26 Jan 2026 19:03:58 GMT

I am also having this issue after upgrading to PAN-OS 11.1.13 from 11.1.6-h14.

Re: Failed logins from 127.0.0.1

jclark996 — Fri, 20 Feb 2026 23:05:26 GMT

I have a customer on Azure with a VM-series firewall on 11.2.8 that was having this same issue. I always delete the default admin account to create new ones but I recreated it with a secure password and the superuser role and those failed logins stopped. Hopefully this helps someone because this was the only thread I had found about it weird issue.

Re: Failed logins from 127.0.0.1

PavelK — Thu, 26 Feb 2026 01:01:01 GMT

Thanks everyone for contribution!

It looks like there is an official KB for this issue: “Authorization failed for user admin via Web from 127.0.0.1: Invalid user.” is seen in the system log of PA-VM on Azure.

Kind Regards

Pavel

Re: Failed logins from 127.0.0.1

J_Healy — Wed, 25 Mar 2026 12:58:28 GMT

Thank you.