{"record":{"id":"580a01c1b15ee7b8","repo":"jellyfin/jellyfin","slug":"user-account-has-been-disabled","errorCode":null,"errorMessage":"User account has been disabled.","messagePattern":"User account has been disabled\\.","errorType":"http","errorClass":"SecurityException","httpStatus":401,"severity":"error","filePath":"Emby.Server.Implementations/HttpServer/Security/AuthService.cs","lineNumber":37,"sourceCode":"        }\n\n        public async Task<AuthorizationInfo> Authenticate(HttpRequest request)\n        {\n            var auth = await _authorizationContext.GetAuthorizationInfo(request).ConfigureAwait(false);\n\n            if (!auth.HasToken)\n            {\n                return auth;\n            }\n\n            if (!auth.IsAuthenticated)\n            {\n                throw new SecurityException(\"Invalid token.\");\n            }\n\n            if (auth.User?.HasPermission(PermissionKind.IsDisabled) ?? false)\n            {\n                throw new SecurityException(\"User account has been disabled.\");\n            }\n\n            return auth;\n        }\n    }\n}\n","sourceCodeStart":19,"sourceCodeEnd":44,"githubUrl":"https://github.com/jellyfin/jellyfin/blob/ae8723026d97b6d0f926638803edef338919b794/Emby.Server.Implementations/HttpServer/Security/AuthService.cs#L19-L44","documentation":"Thrown by AuthService.Authenticate when the resolved auth.User has the IsDisabled permission flag set (HasPermission returns true, with a null-safe coalesce). It is a SecurityException and fires only after the token is validated as authentic, so it indicates an explicitly disabled account, not a bad token.","triggerScenarios":"An authenticated request from a user account that an administrator has disabled (PermissionKind.IsDisabled).","commonSituations":"Admin disabled the account after issues; temporary suspension; compromised-account lockdown; migration left accounts in a disabled state.","solutions":["Have an administrator re-enable the user account (clear IsDisabled).","Surface a clear 'account disabled' message to the end user and direct them to an admin.","Do not retry with the same credentials; the failure is intentional policy, not transient.","Audit user management to confirm the disable was intended."],"exampleFix":"// before: requests from disabled user throw\n// after (admin action)\nuser.SetPermission(PermissionKind.IsDisabled, false);\nawait _userManager.UpdateUserAsync(user);","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await _authService.Authenticate(request); }\ncatch (SecurityException ex) when (ex.Message.Contains(\"disabled\")) { return Forbid(\"Account disabled\"); }","preventionTips":["Do not retry disabled-account requests; surface a re-enable path.","Audit disabled accounts in user management."],"tags":["authentication","security","authorization","user-management"],"backgroundTag":null,"analyzedSha":"ae8723026d97b6d0f926638803edef338919b794","analyzedAt":"2026-08-13T10:43:30.013Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}