RocketChat/Rocket.Chat · error · Meteor.Error

error-user-not-found

error-user-not-found

Error message

user not found

What it means

Thrown by POST twoFactorChallenges.sendEmailCode when the user attached to the pending challenge no longer exists (getUserForCheck returns null). The challenge holds a userId; if that account was deleted or suspended mid-flow, the code cannot be emailed.

Source

Thrown at apps/meteor/server/api/v1/twoFactorChallenges.ts:42

			if (!challenge) {
				throw new Meteor.Error('error-challenge-not-found', 'challenge not found');
			}

			if (challenge.expireAt && challenge.expireAt < new Date()) {
				throw new Meteor.Error('error-challenge-expired', 'challenge expired');
			}

			if (challenge.method !== 'email') {
				throw new Meteor.Error('error-invalid-challenge-method', 'invalid challenge method');
			}

			const { userId } = challenge;

			const user = await getUserForCheck(userId);

			if (!user) {
				throw new Meteor.Error('error-user-not-found', 'user not found');
			}

			await emailCheckForOAuth.sendEmailCode(user);

			return API.v1.success();
		},
	},
);

API.v1.addRoute(
	'twoFactorChallenges.verifyChallenge',
	{
		validateParams: isTwoFactorChallengesVerifyChallengeParamsPOST,
		rateLimiterOptions: { intervalTimeInMS: 60000, numRequestsAllowed: 5 },
	},
	{
		async post() {
			const { challengeId, code } = this.bodyParams;

View on GitHub (pinned to b2c16d5842)

Solutions

1. Verify the account still exists and is active (users.info) when debugging
2. Treat as terminal: abort the flow and ask the user to authenticate again — a recreated account needs a new login
3. In test suites, create the user, run the whole 2FA flow, then tear down — never between calls

catch (e) { if (e?.error === 'error-user-not-found') abortWithAccountUnavailable(); else throw e; }

When it happens

Trigger: OAuth login starts, an admin deletes or deactivates the account before the user finishes the email 2FA step; test accounts wiped between login and code entry; user merged/deactivated by a directory sync during the flow.

Common situations: Test suites with teardown running between calls; LDAP/SCIM sync deactivating users while they log in; staging environments with aggressive user cleanup.

Related errors

• error-challenge-not-found
• error-parameter-required
• error-challenge-expired
• error-invalid-challenge-method
• totp-max-attempts

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/9ad0c46968ec842d. Report an issue: GitHub.