MHSanaei/3x-ui · warning

The current username or password is invalid

Error message

The current username or password is invalid

What it means

The updateUser handler rejects the change because the presented old username does not match the session user's username OR the old password fails bcrypt verification (crypto.CheckPasswordHash). The visible text comes from the i18n key pages.settings.toasts.originalUserPassIncorrect. It is an authentication gate on credential rotation, separate from 2FA which is checked later.

Source

Thrown at internal/web/controller/setting.go:180

				oldTgAPIServer != allSetting.TgBotAPIServer))
		if tgChanged {
			reloadTgbotFunc()
		}
	}
	jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
}

// updateUser updates the current user's username and password.
func (a *SettingController) updateUser(c *gin.Context) {
	form := &updateUserForm{}
	err := c.ShouldBind(form)
	if err != nil {
		jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
		return
	}
	user := session.GetLoginUser(c)
	if user.Username != form.OldUsername || !crypto.CheckPasswordHash(user.Password, form.OldPassword) {
		jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifyUserError"), errors.New(I18nWeb(c, "pages.settings.toasts.originalUserPassIncorrect")))
		return
	}
	if form.NewUsername == "" || form.NewPassword == "" {
		jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifyUserError"), errors.New(I18nWeb(c, "pages.settings.toasts.userPassMustBeNotEmpty")))
		return
	}
	if err := a.settingService.VerifyTwoFactorCode(form.TwoFactorCode); err != nil {
		jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifyUserError"), err)
		return
	}
	err = a.userService.UpdateUser(user.Id, form.NewUsername, form.NewPassword)
	if err == nil {
		user.Username = form.NewUsername
		user.Password, _ = crypto.HashPasswordAsBcrypt(form.NewPassword)
		if saveErr := session.SetLoginUser(c, user); saveErr != nil {
			err = saveErr
		}
	}

View on GitHub (pinned to ad32144c42)

Solutions

1. Re-enter the current (pre-change) username and password exactly as stored — not the new values
2. Check for stray whitespace/newlines from paste or autofill
3. If genuinely forgotten, reset from the CLI/DB side (admin path) rather than retrying the form
4. Confirm the session itself is not stale (re-login) before retrying

When it happens

Trigger: POST to the settings update endpoint with a stale username (e.g. changed in another tab), a typo'd old password, or autofill inserting the wrong value into oldUsername/oldPassword form fields.

Common situations: Password managers autofilling the wrong credential pair; the user editing credentials after an admin already renamed the account; leading/trailing whitespace from copy-paste.

Related errors

• The new username and password are empty
• telegram bot disabled
• email service not available
• bot not started
• tg_id must be a positive integer

AI-assisted analysis of MHSanaei/3x-ui@ad32144c42 (2026-08-15). Data as JSON: /api/errors/21381a2553d55d6e. Report an issue: GitHub.