{"record":{"id":"9128b6053baecc7f","repo":"bitwarden/server","slug":"user-email-does-not-match-invite","errorCode":null,"errorMessage":"User email does not match invite.","messagePattern":"User email does not match invite\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs","lineNumber":267,"sourceCode":"        {\n            throw new BadRequestException(\"User invalid.\");\n        }\n\n        if (providerUser.Status != ProviderUserStatusType.Invited)\n        {\n            throw new BadRequestException(\"Already accepted.\");\n        }\n\n        if (!CoreHelpers.TokenIsValid(\"ProviderUserInvite\", _dataProtector, token, user.Email, providerUser.Id,\n            _globalSettings.OrganizationInviteExpirationHours))\n        {\n            throw new BadRequestException(\"Invalid token.\");\n        }\n\n        if (string.IsNullOrWhiteSpace(providerUser.Email) ||\n            !providerUser.Email.Equals(user.Email, StringComparison.InvariantCultureIgnoreCase))\n        {\n            throw new BadRequestException(\"User email does not match invite.\");\n        }\n\n        var organizationAutoConfirmPolicyRequirement = await _policyRequirementQuery\n            .GetAsync<AutomaticUserConfirmationPolicyRequirement>(user.Id);\n\n        if (organizationAutoConfirmPolicyRequirement\n            .CannotJoinProvider())\n        {\n            throw new BadRequestException(new UserCannotJoinProvider().Message);\n        }\n\n        providerUser.Status = ProviderUserStatusType.Accepted;\n        providerUser.UserId = user.Id;\n        providerUser.Email = null;\n\n        await _providerUserRepository.ReplaceAsync(providerUser);\n\n        return providerUser;","sourceCodeStart":249,"sourceCodeEnd":285,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs#L249-L285","documentation":"Thrown inside AcceptUserAsync when the logged-in user's email does not match the ProviderUser.Email recorded on the invite (case-insensitive comparison). This prevents accepting an invite intended for a different account. BadRequestException (HTTP 400).","triggerScenarios":"Logged in as user A but the invite email is for user B; whitespace/alias differences in the stored email.","commonSituations":"Wrong account logged in; email alias (+tag) differences; email changed on the account after the invite was sent.","solutions":["Log in with the exact email the invite was sent to.","Have the admin resend the invite to the user's current email.","Trim/normalize email input when generating invites."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (string.IsNullOrWhiteSpace(providerUser.Email) ||\n    !providerUser.Email.Equals(user.Email, StringComparison.InvariantCultureIgnoreCase))\n    throw new InvalidOperationException(\"Logged-in email does not match the invite recipient.\");","typeGuard":null,"tryCatchPattern":"try { await _providerService.AcceptUserAsync(providerUserId, user, token); }\ncatch (BadRequestException ex) when (ex.Message.Contains(\"email does not match\"))\n{ /* instruct user to log in with the invited email */ }","preventionTips":["Log in with the exact email the invite was sent to.","Resend the invite to the user's current email if it changed.","Normalize/trim emails when creating invites."],"tags":["provider","invite","email-match","security","bitwarden"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}