What causes "Account password does not match." in alibaba/spring-ai-alibaba?

Re-enter the current (old) password carefully — verify with PasswordCryptUtils.match logic mentally: it must match the stored hash

alibaba/spring-ai-alibaba · error · BizException

AccountPasswordNotMatch

AccountPasswordNotMatch

Error message

Account password does not match.

What it means

BizException thrown by changePassword when request.getPassword() (the current/old password) does not match the stored bcrypt-encoded password. PasswordCryptUtils.match fails, so the change is aborted with ErrorCode.ACCOUNT_PASSWORD_NOT_MATCH before the new password is encoded and saved.

Solutions

Re-enter the current (old) password carefully — verify with PasswordCryptUtils.match logic mentally: it must match the stored hash
Ensure the client maps the correct form field to ChangePasswordRequest.password (old) vs newPassword (new)
If the password was reset/forgotten, use an admin password reset or 'forgot password' flow instead of changePassword
Catch BizException code AccountPasswordNotMatch and show a 'current password is incorrect' message with a limited retry count

Example fix

// before
ChangePasswordRequest req = new ChangePasswordRequest();
req.setPassword(newPassword); // WRONG: this is the old-password field
// after
ChangePasswordRequest req = new ChangePasswordRequest();
req.setPassword(currentPassword); // must match stored hash
req.setNewPassword(newPassword);
accountService.changePassword(req);

Defensive patterns

Strategy: try-catch

Validate before calling

if (currentPassword == null || currentPassword.isBlank()) {
    throw new IllegalArgumentException("Current password is required");
}

Try / catch

try {
    accountService.changePassword(request);
} catch (BizException e) {
    if ("AccountPasswordNotMatch".equals(e.getCode())) {
        throw new UserFacingException("Your current password is incorrect.");
    }
    throw e;
}

Prevention

Verify the client binds the OLD password to request.password and the NEW one to newPassword
Limit retries and add rate limiting on password-change endpoints
Warn users if their password was recently changed in another session
Prefer a 'forgot password' flow over changePassword when the old password is unknown

When it happens

Trigger: Submitting a changePassword request whose current-password field is wrong, empty, or belongs to a different account; also triggered after a password was already changed elsewhere so the stored hash differs from what the user supplies.

Common situations: Typo or caps-lock in the 'current password' field; user changed the password in another tab/device and retries with the old one; front end sending the NEW password in the old-password field; password set via admin reset so the user's remembered old password is outdated.

Related errors

AI-assisted analysis of alibaba/spring-ai-alibaba@f82da0b50f (2026-09-09). Data as JSON: /api/errors/df51024af4383971. Report an issue: GitHub.

Appendix: source

Thrown at spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/base/service/impl/AccountServiceImpl.java:473

		return toAccountDTO(entity);
	}

	/**
	 * Changes user password
	 * @param request Password change request
	 */
	@Override
	public void changePassword(ChangePasswordRequest request) {
		RequestContext context = RequestContextHolder.getRequestContext();
		AccountEntity entity = getAccountById(context.getAccountId());

		if (Objects.isNull(entity)) {
			throw new BizException(ErrorCode.ACCOUNT_NOT_FOUND.toError());
		}

		if (!PasswordCryptUtils.match(request.getPassword(), entity.getPassword())) {
			throw new BizException(ErrorCode.ACCOUNT_PASSWORD_NOT_MATCH.toError());
		}

		String newEncodedPassword = PasswordCryptUtils.encode(request.getNewPassword());
		entity.setPassword(newEncodedPassword);
		entity.setGmtModified(new Date());
		this.updateById(entity);

		String key = getAccountCacheKey(context.getAccountId());
		redisManager.put(key, entity);
	}

	/**
	 * Gets current user's profile
	 * @return Account profile
	 */
	@Override
	public Account getAccountProfile() {
		RequestContext context = RequestContextHolder.getRequestContext();

View on GitHub (pinned to f82da0b50f)