{"record":{"id":"61f21d35eaecdf7a","repo":"open-webui/open-webui","slug":"the-email-or-password-provided-is-incorrect-pleas","errorCode":null,"errorMessage":"The email or password provided is incorrect. Please check for typos and try logging in again.","messagePattern":"The email or password provided is incorrect\\. Please check for typos and try logging in again\\.","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"warning","filePath":"backend/open_webui/routers/auths.py","lineNumber":341,"sourceCode":"    if session_user:\n        user = await Users.update_user_by_id(\n            session_user.id,\n            form_data.model_dump(),\n            db=db,\n        )\n        if user:\n            await publish_event(\n                request,\n                EVENTS.USER_PROFILE_UPDATED,\n                actor=session_user,\n                subject_id=session_user.id,\n                data={'updated_fields': list(form_data.model_dump().keys())},\n            )\n            return user\n        else:\n            raise HTTPException(400, detail=ERROR_MESSAGES.DEFAULT())\n    else:\n        raise HTTPException(400, detail=ERROR_MESSAGES.INVALID_CRED)\n\n\n############################\n# Update Timezone\n############################\n\n\nclass UpdateTimezoneForm(BaseModel):\n    timezone: str\n\n\n@router.post('/update/timezone')\nasync def update_timezone(\n    request: Request,\n    form_data: UpdateTimezoneForm,\n    session_user=Depends(get_current_user),\n    db: AsyncSession = Depends(get_async_session),\n):","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/open-webui/open-webui/blob/01f4282f1ffe0d6212f58d3afbeae21fffd0c4be/backend/open_webui/routers/auths.py#L323-L359","documentation":"400 INVALID_CRED ('email or password ... incorrect') from the profile-update endpoint: `Auths.authenticate_user(session_user.email, verify_password(form_data.password))` returned falsy. Users must re-supply their current password to change profile fields; a mismatch (wrong password, password changed elsewhere, or auth record stored differently) yields this generic credentials error rather than a password-specific one.","triggerScenarios":"POST /api/v1/auths/update/profile where the 'password' form field does not verify against the stored bcrypt/passlib hash for the session user's email — typo, stale password after a recent change on another device, or copy-paste with whitespace.","commonSituations":"Users who recently rotated passwords using an old cached form; password managers autocompleting an outdated entry; accounts provisioned via LDAP/OAuth where no local password exists, so any supplied password fails verification.","solutions":["Re-enter the current account password in the confirmation field of the profile editor.","If the password was forgotten, use admin-initiated password reset (Admin Panel > Users > reset) instead of guessing.","For LDAP/OAuth-managed accounts, update the profile fields that do not require password confirmation, or have the admin adjust them.","Check for leading/trailing spaces or autofill artifacts in the submitted password field."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Client-side pre-check: only submit when a fresh password was typed\nfunction canSubmitProfileForm(password: string): boolean {\n  return password.trim().length > 0; // server will still verify the hash\n}","typeGuard":null,"tryCatchPattern":"from fastapi import HTTPException\ntry:\n    resp = await client.post('/api/v1/auths/update/profile', json=payload)\nexcept HTTPException as e:\n    if e.status_code == 400 and 'email or password' in str(e.detail).lower():\n        # wrong CURRENT password: prompt user, never auto-retry with same value\n        show_inline_error('Re-enter your current password')\n    raise","preventionTips":["Label the field 'Current password' clearly; disable password-manager autofill (autocomplete='new-password' tricks aside).","After any password change, immediately update the stored credential so later confirmations pass.","Remember: profile edits need password re-confirmation in this build — budget for it in the UI."],"tags":["open-webui","authentication","password","profile-update","http-400"],"backgroundTag":null,"analyzedSha":"01f4282f1ffe0d6212f58d3afbeae21fffd0c4be","analyzedAt":"2026-08-14T18:25:22.715Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}