SigNoz/signoz · error · errors.Error

ErrCodeIncorrectPassword

ErrCodeIncorrectPassword

Error message

old password is incorrect

What it means

UpdatePassword verifies the current password before allowing a change; if password.Equals(oldpasswd) fails it returns ErrCodeIncorrectPassword (TypeInvalidInput).

Source

Thrown at pkg/modules/user/impluser/setter.go:491

	if err != nil {
		return err
	}

	if err := user.ErrIfDeleted(); err != nil {
		return errors.WithAdditionalf(err, "cannot change password for deleted user")
	}

	if err := user.ErrIfRoot(); err != nil {
		return errors.WithAdditionalf(err, "cannot change password for root user")
	}

	password, err := module.store.GetPasswordByUserID(ctx, userID)
	if err != nil {
		return err
	}

	if !password.Equals(oldpasswd) {
		return errors.New(errors.TypeInvalidInput, types.ErrCodeIncorrectPassword, "old password is incorrect")
	}

	if err := password.Update(passwd); err != nil {
		return err
	}

	if err := module.store.RunInTx(ctx, func(ctx context.Context) error {
		if err := module.store.UpdatePassword(ctx, password); err != nil {
			return err
		}

		if err := module.store.DeleteResetPasswordTokenByPasswordID(ctx, password.ID); err != nil {
			return err
		}

		return nil
	}); err != nil {
		return err

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Re-enter the correct current password (verify by logging in with it)
2. If truly forgotten, use the forgot-password/admin reset flow instead of the change-password endpoint
3. Trim whitespace and disable autofill interference on the old-password field

ok := verifyCurrentPassword(oldPassword) // e.g. re-login check
if !ok {
    return errors.New("incorrect current password")
}
updatePassword(ctx, userID, oldPassword, newPassword)

err := updatePassword(ctx, userID, old, new)
if err != nil && types.IsErrCode(err, types.ErrCodeIncorrectPassword) {
    // re-prompt for current password, or route to forgot-password
}

When it happens

Trigger: PUT/PATCH change-password endpoint where the supplied old/current password doesn't match the stored hash — typo, stale password, or password already changed elsewhere.

Common situations: User has multiple tabs/sessions and changed the password in one; password manager stored an outdated credential; copy/paste with trailing whitespace.

Related errors

• ErrCodeResetPasswordTokenExpired
• CodeInvalidInput
• ErrCodeResetPasswordTokenExpired
• CodeLicenseUnavailable
• CodeLicenseUnavailable

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/43da14c28caac840. Report an issue: GitHub.