After updating to 8.18 some existing users (apparently those with moderator or admin privileges) face stochastic problems with login to the site with the REST service. Login via Drupal standard interface posed no problem for the same users. I tried to clear the cache, reinitialize the passwords, nothing helped. The next day, magically users could log in.
In the logs I see only this:
Type: access denied
User: Anonymous (not verified)
Message: /user/login?_format=json
I haven't seen this behavior previously but maybe the issue is even older than 8.17