{"record":{"id":"9069ac177408f8bf","repo":"OrchardCMS/OrchardCore","slug":"the-username-or-e-mail-or-password-provided-is-incorrect","errorCode":null,"errorMessage":"The username or e-mail or password provided is incorrect.","messagePattern":"The username or e-mail or password provided is incorrect\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/OrchardCore.Modules/OrchardCore.Lists/RemotePublishing/MetaWeblogHandler.cs","lineNumber":467,"sourceCode":"        if (!await _authorizationService.AuthorizeAsync(user, CommonPermissions.DeleteContent, contentItem))\n        {\n            throw new InvalidOperationException(S[\"Not authorized to delete this content\"].Value);\n        }\n\n        foreach (var driver in drivers)\n        {\n            driver.Process(contentItem.ContentItemId);\n        }\n\n        await _contentManager.RemoveAsync(contentItem);\n        return true;\n    }\n\n    private async Task<ClaimsPrincipal> ValidateUserAsync(string userName, string password)\n    {\n        if (!await _membershipService.CheckPasswordAsync(userName, password))\n        {\n            throw new InvalidOperationException(S[\"The username or e-mail or password provided is incorrect.\"].Value);\n        }\n\n        var storeUser = await _membershipService.GetUserAsync(userName);\n\n        if (storeUser == null)\n        {\n            return null;\n        }\n\n        return await _membershipService.CreateClaimsPrincipal(storeUser);\n    }\n\n    private async Task<XRpcStruct> CreateBlogStructAsync(XmlRpcContext context, ContentItem contentItem)\n    {\n        var metadata = await _contentManager.PopulateAspectAsync<ContentItemMetadata>(contentItem);\n\n        var url = context.Url.Action(\n            metadata.DisplayRouteValues[\"action\"].ToString(),","sourceCodeStart":449,"sourceCodeEnd":485,"githubUrl":"https://github.com/OrchardCMS/OrchardCore/blob/4306c0717fe573f6fca1b4955909ddab6a192807/src/OrchardCore.Modules/OrchardCore.Lists/RemotePublishing/MetaWeblogHandler.cs#L449-L485","documentation":"ValidateUserAsync verifies the supplied MetaWeblog credentials via IMembershipService.CheckPasswordAsync before any other operation. If the username/e-mail and password combination does not validate, an InvalidOperationException is thrown. This is the standard authentication gate for all MetaWeblog XML-RPC calls.","triggerScenarios":"Any MetaWeblog XML-RPC call (newPost, editPost, getPost, getRecentPosts, deletePost) with a wrong password, a nonexistent username/e-mail, or credentials for a user that cannot be resolved.","commonSituations":"Stale saved passwords in blogging clients after a password change; typing the e-mail in the username field with a mismatched password; users whose accounts were disabled; case/format mismatches.","solutions":["Re-enter the correct username (or e-mail) and password in the remote blogging client.","Reset the user's password in Admin > Security > Users and update the client.","Verify the user account exists and is enabled.","Ensure the site's membership settings allow password checking for this user type."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate credentials before invoking MetaWeblog calls\nif (string.IsNullOrWhiteSpace(userName) || string.IsNullOrWhiteSpace(password))\n    throw new ArgumentException(\"MetaWeblog credentials must be provided.\");","typeGuard":null,"tryCatchPattern":"try { await handler.GetUsersBlogsAsync(appKey, userName, password); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"username or e-mail or password\"))\n{ /* prompt the user to re-enter credentials */ }","preventionTips":["Store and refresh credentials in the client after password changes.","Prefer app-specific passwords if the site supports them.","Verify the account exists and is not locked out before automating calls."],"tags":["authentication","xml-rpc","metaweblog","credentials"],"backgroundTag":"authentication-required","analyzedSha":"4306c0717fe573f6fca1b4955909ddab6a192807","analyzedAt":"2026-09-13T17:41:05.024Z","contentChangedAt":"2026-09-13T17:41:05.024Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}