{"record":{"id":"a59b7862f3c4926a","repo":"open-webui/open-webui","slug":"the-password-provided-is-incorrect-please-check-f","errorCode":null,"errorMessage":"The password provided is incorrect. Please check for typos and try again.","messagePattern":"The password provided is incorrect\\. Please check for typos and try again\\.","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"warning","filePath":"backend/open_webui/routers/auths.py","lineNumber":417,"sourceCode":"\n        if user:\n            try:\n                validate_password(form_data.new_password)\n            except Exception as e:\n                raise HTTPException(400, detail=str(e))\n            hashed = await get_password_hash(form_data.new_password)\n            success = await Auths.update_user_password_by_id(user.id, hashed, db=db)\n            if success:\n                await publish_event(\n                    request,\n                    EVENTS.AUTH_PASSWORD_CHANGED,\n                    actor=user,\n                    subject_id=user.id,\n                    subject_type='user',\n                )\n            return success\n        else:\n            raise HTTPException(400, detail=ERROR_MESSAGES.INCORRECT_PASSWORD)\n    else:\n        raise HTTPException(400, detail=ERROR_MESSAGES.INVALID_CRED)\n\n\ndef _unescape_ldap_dn_value(value: str) -> str:\n    \"\"\"Resolve RFC 4514 escapes in a DN value, e.g. ``CN=Sales\\\\, EMEA`` -> ``Sales, EMEA``.\n\n    Consecutive ``\\\\XX`` hex escapes encode UTF-8 bytes and are decoded together.\n    \"\"\"\n    hexdigits = '0123456789abcdefABCDEF'\n    result = []\n    pos = 0\n    length = len(value)\n    while pos < length:\n        char = value[pos]\n        if char == '\\\\' and pos + 1 < length:\n            if pos + 2 < length and value[pos + 1] in hexdigits and value[pos + 2] in hexdigits:\n                byte_values = bytearray()","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/open-webui/open-webui/blob/01f4282f1ffe0d6212f58d3afbeae21fffd0c4be/backend/open_webui/routers/auths.py#L399-L435","documentation":"400 INCORRECT_PASSWORD from update_password: the user record exists and the session is valid, but `Auths.authenticate_user(session_user.email, verify_password(form_data.password))` returned falsy — the supplied CURRENT password does not match the stored hash. Distinct from INVALID_CRED (which covers missing session user); this specifically says the old password is wrong.","triggerScenarios":"POST /update/password where form_data.password is not the account's current password: typo, password already changed on another device, admin-reset password the user hasn't seen, or autofill of an old credential.","commonSituations":"Password managers injecting stale entries; concurrent sessions after a reset; users confusing the old and new password fields.","solutions":["Re-enter the CURRENT password (not the new one) in the old-password field and retry.","If forgotten, request an admin reset, then change it again with the temporary value as the old password.","Update the password manager entry to the current password before retrying.","Verify no whitespace/case-transform is being applied by the client."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Verify the current password before calling the endpoint\nfrom passlib.context import CryptContext\npwd_ctx = CryptContext(schemes=['bcrypt'], deprecated='auto')\n\ndef current_password_correct(supplied: str, stored_hash: str) -> bool:\n    return pwd_ctx.verify(supplied, stored_hash)  # only possible when you hold the hash","typeGuard":null,"tryCatchPattern":"from fastapi import HTTPException\ntry:\n    await client.post('/api/v1/auths/update/password', json=payload)\nexcept HTTPException as e:\n    if e.status_code == 400 and 'password provided is incorrect' in str(e.detail):\n        # old password mismatch: re-prompt for CURRENT password; do not resend\n        focus_old_password_field()\n    raise","preventionTips":["Distinguish 'Current password' and 'New password' fields visually and in autofill attributes.","After any successful password change, immediately update the password manager entry.","Offer an admin-reset escape hatch in the UI instead of repeated guessing (which may trip lockouts)."],"tags":["open-webui","authentication","password","http-400"],"backgroundTag":null,"analyzedSha":"01f4282f1ffe0d6212f58d3afbeae21fffd0c4be","analyzedAt":"2026-08-14T18:25:22.715Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}