UPDATE: This issue is fixed by the August 2026 updates.
The July 2026 update was released July 14, 2026. This introduced many security fixes but this can cause issues with your SAML, OIDC, or FBA implementations. This can prevent tokens from being added or read from dcache.
Here are some logs from my 2019 farm:
07/18/2026 12:18:03.74 w3wp.exe (0x0FF8) 0x1914 SharePoint Foundation DistributedCache air38 Medium Token Cache: Failed to add token from distributed cache. Key: ‘0e.t|microsoftentratrust|user1@TestTestTest.onmicrosoft.com’, Exception: ‘System.NotSupportedException: Specified method is not supported. at Microsoft.SharePoint.IdentityModel.SPTokenCache.NotSupportedCookieTransform.Encode(Byte[] value) at Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler.ApplyTransforms(Byte[] cookie, Boolean outbound) at Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler.WriteToken(XmlWriter writer, SecurityToken token) at Microsoft.IdentityModel.Tokens.SecurityTokenSerializerAdapter.WriteTokenCore(XmlWriter writer, SecurityToken token) at Microsoft.SharePoint.Administration.Claims.SPTokenCacheEntry.SerializeToken(SecurityTokenSerializer tokenSerializer) at Microsoft.SharePoint.IdentityModel.SPDistributedSecurityTokenCache.Put(String key, Object value) at Microsoft.SharePoint.IdentityModel.SPTokenCache.AddCachedTokenV1(String cachekey, SPTokenCacheEntry value)’. 908628a2-2a7c-10e3-545f-1f5de6df25d3
07/18/2026 12:18:03.74 w3wp.exe (0x0FF8) 0x1914 SharePoint Foundation DistributedCache air39 Medium Token Cache: Reverting to local cache to Add the token. Key: ‘0e.t|microsoftentratrust|user1@TestTestTest.onmicrosoft.com’. 908628a2-2a7c-10e3-545f-1f5de6df25d3
Log entry from SPSE:
07/23/2026 14:34:31.14 w3wp.exe (0x6128) 0x2814 SharePoint Foundation DistributedCache aa6e6 Unexpected Unexpected error in ByteArrayToObject – Exception ‘System.NotSupportedException: Specified method is not supported. at Microsoft.SharePoint.IdentityModel.SPSessionSecurityTokenHandlerV2.ReadToken(XmlReader reader) at System.IdentityModel.Tokens.SecurityTokenHandlerCollection.ReadToken(XmlReader reader) at Microsoft.SharePoint.Administration.Claims.SPTokenCacheEntry..ctor(SerializationInfo info, StreamingContext context) at ReadSPTokenCacheEntryFromXml(XmlReaderDelegator , XmlObjectSerializerReadContext , XmlDictionaryString[] , XmlDictionaryString[] ) at System.Runtime.Serialization.ClassDataContract.ReadXmlValue(XmlReaderDelegator xmlReader, XmlObjectSerializerReadContext context) at System.Runtime.Serialization.XmlObjectSerializerReadContext.InternalDeserialize(XmlReaderDelegator reader, String name, String ns, Type declaredType, DataContract& dataContract) at System.Runtime.Serialization.XmlObjectSerializerReadContext.InternalDeserialize(XmlReaderDelegator xmlReader, Type declaredType, DataContract dataContract, String name, String ns) at System.Runtime.Serialization.DataContractSerializer.InternalReadObject(XmlReaderDelegator xmlReader, Boolean verifyObjectName, DataContractResolver dataContractResolver) at System.Runtime.Serialization.XmlObjectSerializer.ReadObjectHandleExceptions(XmlReaderDelegator reader, Boolean verifyObjectName, DataContractResolver dataContractResolver) at System.Runtime.Serialization.XmlObjectSerializer.ReadObject(XmlDictionaryReader reader) at Microsoft.SharePoint.DistributedCaching.SPDistributedCacheUtils.ByteArrayToObject[T](Byte[] Buffer)’.
The PG is currently investigating the issue above and hoping to get a fix sooner than later. I would suggest using sticky sessions or persistence at your NLB. Failing to read a token from the dcache will fall back to the local cache(the STS). If the request hits a different WFE than the one you and the token is unable to be located (dcache and local), SharePoint invalidates the clients FedAuth cookie and makes them reauthenticate.