AlistGo/alist · error

password has been changed

Error message

password has been changed

What it means

Returned by authenticateToken (server/mcp/auth.go:79) when the JWT's PwdTS claim does not equal the current user.PwdTS — the password was changed (or the account's password timestamp was bumped) after this token was issued. It is a deliberate invalidation of all pre-change tokens, not corruption.

Source

Thrown at server/mcp/auth.go:79

		if err := loadRoles(guest); err != nil {
			return nil, err
		}
		return guest, nil
	}

	// JWT token
	claims, err := common.ParseToken(token)
	if err != nil {
		return nil, fmt.Errorf("invalid token: %w", err)
	}

	user, err := op.GetUserByName(claims.Username)
	if err != nil {
		return nil, fmt.Errorf("user not found: %w", err)
	}

	if claims.PwdTS != user.PwdTS {
		return nil, fmt.Errorf("password has been changed")
	}
	if user.Disabled {
		return nil, fmt.Errorf("user is disabled")
	}

	if err := loadRoles(user); err != nil {
		return nil, err
	}
	return user, nil
}

func loadRoles(user *model.User) error {
	if len(user.Role) > 0 {
		roles, err := op.GetRolesByUserID(user.ID)
		if err != nil {
			return fmt.Errorf("failed to load roles: %w", err)
		}
		user.RolesDetail = roles

View on GitHub (pinned to 843d9dc814)

Solutions

1. Log in again after any password change and update the stored MCP token
2. Treat this specific message as 're-authenticate', not 'retry'
3. For service accounts, avoid password rotation or automate token refresh after rotation

if err != nil && strings.Contains(err.Error(), "password has been changed") { token = login(user, newPassword); retryOnce() }

When it happens

Trigger: User changed their password in the web UI, then an MCP client reuses the old token; admin reset a password, invalidating every token that user had issued.

Common situations: Automation tokens breaking after routine password rotation; shared accounts whose password is changed by one team while another team's tooling still holds the old token.

Related errors

• SafePassword is incorrect
• password is empty
• password is incorrect
• failed to get admin: %w
• failed to get guest: %w

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/5bf24fcb04bf78d7. Report an issue: GitHub.