RocketChat/Rocket.Chat · error · Meteor.Error

error-password-same-as-current

error-password-same-as-current

Error message

Entered password same as current password

What it means

Password self-service guard inside saveUserProfile: when settings.newPassword is set, Accounts_AllowPasswordChange is true, and the user has a bcrypt password, the server compares the new password against the current hash via compareUserPassword. A match means the user submitted their existing password as the 'new' one and the change is refused before passwordPolicy.validate or Accounts.setPasswordAsync run.

Source

Thrown at apps/meteor/server/meteor-methods/users/saveUserProfile.ts:127

		if (settings.nickname.length > MAX_NICKNAME_LENGTH) {
			throw new Meteor.Error('error-nickname-size-exceeded', `Nickname size exceeds ${MAX_NICKNAME_LENGTH} characters`, {
				method: 'saveUserProfile',
			});
		}
		await Users.setNickname(user._id, settings.nickname.trim());
	}

	if (user && settings.email) {
		await setEmailFunction(settings.email, user);
	}

	const canChangePasswordForOAuth = rcSettings.get<boolean>('Accounts_AllowPasswordChangeForOAuthUsers');
	if (canChangePasswordForOAuth || user?.services?.password) {
		// Should be the last check to prevent error when trying to check password for users without password
		if (settings.newPassword && rcSettings.get<boolean>('Accounts_AllowPasswordChange') === true && user?.services?.password?.bcrypt) {
			// don't let user change to same password
			if (user && (await compareUserPassword(user, { plain: settings.newPassword }))) {
				throw new Meteor.Error('error-password-same-as-current', 'Entered password same as current password', {
					method: 'saveUserProfile',
				});
			}

			if (user?.services?.passwordHistory && !(await compareUserPasswordHistory(user, { plain: settings.newPassword }))) {
				throw new Meteor.Error('error-password-in-history', 'Entered password has been previously used', {
					method: 'saveUserProfile',
				});
			}

			passwordPolicy.validate(settings.newPassword);

			await Accounts.setPasswordAsync(this.userId, settings.newPassword, {
				logout: false,
			});

			if (user.requirePasswordChange) {
				await Users.unsetRequirePasswordChange(user._id);

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Compare the new-password field against the current-password field client-side and block identical values
  2. Catch error-password-same-as-current and show 'New password must be different from your current password'
  3. Clear the new-password field after a failed attempt so resubmission cannot reuse the value

Example fix

// before
if (newPassword) Meteor.call('saveUserProfile', { newPassword }, customFields);

// after
if (newPassword && newPassword === currentPassword) {
  showError('New password must differ from the current one');
} else {
  Meteor.call('saveUserProfile', { newPassword }, customFields);
}
Defensive patterns

Strategy: validation

Validate before calling

if (newPassword && currentPassword && newPassword === currentPassword) {
  throw new Error('New password must differ from the current password');
}

Try / catch

catch (err) {
  if (err instanceof Meteor.Error && err.error === 'error-password-same-as-current') {
    showFieldError('newPassword', 'Choose a password you have not used before');
    clearField('newPassword');
  }
}

Prevention

When it happens

Trigger: settings.newPassword === current password for a password-authenticated user with Accounts_AllowPasswordChange=true; OAuth-only users without services.password.bcrypt never reach this check.

Common situations: Change-password forms where the user retypes the old password into the new-password field; forms that pre-fill the new password; automated flows that 'reset' to the same password.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/d42065d5db076d5a. Report an issue: GitHub.