{"record":{"id":"1b2bde00c08dcb4f","repo":"Mintplex-Labs/anything-llm","slug":"invalid-password-1b2bde","errorCode":null,"errorMessage":"Invalid password.","messagePattern":"Invalid password\\.","errorType":"http","errorClass":null,"httpStatus":500,"severity":"warning","filePath":"server/endpoints/system.js","lineNumber":438,"sourceCode":"    \"/system/reset-password\",\n    [isMultiUserSetup],\n    async (request, response) => {\n      try {\n        const { token, newPassword, confirmPassword } = reqBody(request);\n        const { success, message, error } = await resetPassword(\n          token,\n          newPassword,\n          confirmPassword\n        );\n\n        if (success) {\n          response.status(200).json({ success, message });\n        } else {\n          response.status(400).json({ success, error });\n        }\n      } catch (error) {\n        console.error(\"Error resetting password:\", error);\n        response.status(500).json({ success: false, message: error.message });\n      }\n    }\n  );\n\n  app.get(\n    \"/system/system-vectors\",\n    [validatedRequest, flexUserRoleValid([ROLES.admin, ROLES.manager])],\n    async (request, response) => {\n      try {\n        const query = queryParams(request);\n        const VectorDb = getVectorDbClass();\n        const vectorCount = !!query.slug\n          ? await VectorDb.namespaceCount(query.slug)\n          : await VectorDb.totalVectors();\n        response.status(200).json({ vectorCount });\n      } catch (e) {\n        console.error(e.message, e);\n        response.sendStatus(500).end();","sourceCodeStart":420,"sourceCodeEnd":456,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/20f6d3546c1938bfea1ad304f58a592dddcc5948/server/endpoints/system.js#L420-L456","documentation":"Message 'Invalid password.' from POST /system/reset-password, arriving as HTTP 500 even though it is a client mistake. resetPassword trims the new password and throws when the result is empty; the endpoint's catch block converts any throw into a 500 JSON response carrying the thrown message verbatim.","triggerScenarios":"POST /system/reset-password with newPassword omitted, empty, or whitespace-only (e.g. \" \") while holding a valid reset token. The empty-check runs before the confirm-password comparison, so confirmPassword is irrelevant here.","commonSituations":"Form submitted before the new-password field was filled; whitespace-only paste; automated tests sending empty strings and misreading the 500 as a server fault.","solutions":["Send a non-empty newPassword after trimming","Note the follow-on rule: the password must also pass the joi-password-complexity check inside User.update (min 8 chars by default, tunable via PASSWORDMINCHAR) or you will get a 400 with that message instead","In clients, treat a 500 from this endpoint carefully — real server faults and this client error share the status code; branch on the message"],"exampleFix":"// before\nawait api.post('/system/reset-password', {\n  token, newPassword: '   ', confirmPassword: '   '\n}); // 500 { success:false, message:'Invalid password.' }\n\n// after\nawait api.post('/system/reset-password', {\n  token, newPassword: 'correct horse battery', confirmPassword: 'correct horse battery'\n});","handlingStrategy":"validation","validationCode":"// Trim and require a non-empty password before calling the API\nconst newPassword = String(rawNewPassword ?? '').trim();\nif (!newPassword) throw new Error('New password is required');\nawait api.post('/system/reset-password', { token, newPassword, confirmPassword: newPassword });","typeGuard":"function isNonEmptyPassword(v) {\n  return typeof v === 'string' && v.trim().length > 0;\n}","tryCatchPattern":null,"preventionTips":["Disable the submit button until both password fields are non-empty","Remember this endpoint returns 500 for what are really client errors — branch on message text","Pre-validate the 8-char (PASSWORDMINCHAR) minimum client-side to avoid the separate 400"],"tags":["validation","password-reset","client-error-as-500","multi-user"],"backgroundTag":"password-policy-violation","analyzedSha":"20f6d3546c1938bfea1ad304f58a592dddcc5948","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}