{"record":{"id":"30e88063c185ecac","repo":"invoke-ai/InvokeAI","slug":"current-password-is-incorrect","errorCode":null,"errorMessage":"Current password is incorrect","messagePattern":"Current password is incorrect","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"invokeai/app/api/routers/auth.py","lineNumber":746,"sourceCode":"    user_service = ApiDependencies.invoker.services.users\n    config = ApiDependencies.invoker.services.configuration\n\n    # Verify current password when attempting a password change\n    if request.new_password is not None:\n        if not request.current_password:\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail=\"Current password is required to set a new password\",\n            )\n\n        # Re-authenticate to verify the current password\n        user = user_service.get(current_user.user_id)\n        if user is None:\n            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=\"User not found\")\n\n        authenticated = user_service.authenticate(user.email, request.current_password)\n        if authenticated is None:\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail=\"Current password is incorrect\",\n            )\n\n    try:\n        changes = UserUpdateRequest(\n            display_name=request.display_name,\n            password=request.new_password,\n        )\n        updated = user_service.update(\n            current_user.user_id, changes, strict_password_checking=config.strict_password_checking\n        )\n    except ValueError as e:\n        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)) from e\n\n    if request.new_password is not None:\n        # Drop the account's other live sockets. They authenticated under the superseded\n        # epoch and would otherwise keep streaming this user's events even though every","sourceCodeStart":728,"sourceCodeEnd":764,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/auth.py#L728-L764","documentation":"When changing a password, update_current_user re-authenticates with user_service.authenticate(user.email, current_password); a None result means the supplied current password is wrong, and the endpoint raises 400 'Current password is incorrect'.","triggerScenarios":"PATCH /auth/me with new_password and a current_password value that does not match the stored password hash for the authenticated user.","commonSituations":"Typo in the current password; password changed in another tab/device so the user's memory is stale; password manager autofilling an outdated password; confusion with an SSO password vs local password.","solutions":["Re-enter the correct current password and retry","If the current password is forgotten, use the password reset flow instead of PATCH /auth/me","Confirm the password manager has the latest saved password (or type it manually)"],"exampleFix":"// before\napi.patch('/auth/me', { new_password: 'new', current_password: 'wrongOld' }); // 400\n// after\nconst ok = confirmCurrentPasswordWithUser(); // prompt again\nif (ok) api.patch('/auth/me', { new_password: 'new', current_password: ok });","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await api.patch('/auth/me', { new_password, current_password });\n} catch (e) {\n  if (e.response?.status === 400 && e.response?.data?.detail === 'Current password is incorrect') {\n    rePromptForCurrentPassword();\n  } else throw e;\n}","preventionTips":["Verify the current password client-side (e.g. a confirm step) before submitting","Keep password managers updated; type manually if autofill fails repeatedly","Use the reset flow when the current password is unknown"],"tags":["http-400","wrong-password","authentication","password-change"],"backgroundTag":"current-password-incorrect","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}