{"record":{"id":"d42065d5db076d5a","repo":"RocketChat/Rocket.Chat","slug":"error-password-same-as-current","errorCode":"error-password-same-as-current","errorMessage":"Entered password same as current password","messagePattern":"Entered password same as current password","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/users/saveUserProfile.ts","lineNumber":127,"sourceCode":"\t\tif (settings.nickname.length > MAX_NICKNAME_LENGTH) {\n\t\t\tthrow new Meteor.Error('error-nickname-size-exceeded', `Nickname size exceeds ${MAX_NICKNAME_LENGTH} characters`, {\n\t\t\t\tmethod: 'saveUserProfile',\n\t\t\t});\n\t\t}\n\t\tawait Users.setNickname(user._id, settings.nickname.trim());\n\t}\n\n\tif (user && settings.email) {\n\t\tawait setEmailFunction(settings.email, user);\n\t}\n\n\tconst canChangePasswordForOAuth = rcSettings.get<boolean>('Accounts_AllowPasswordChangeForOAuthUsers');\n\tif (canChangePasswordForOAuth || user?.services?.password) {\n\t\t// Should be the last check to prevent error when trying to check password for users without password\n\t\tif (settings.newPassword && rcSettings.get<boolean>('Accounts_AllowPasswordChange') === true && user?.services?.password?.bcrypt) {\n\t\t\t// don't let user change to same password\n\t\t\tif (user && (await compareUserPassword(user, { plain: settings.newPassword }))) {\n\t\t\t\tthrow new Meteor.Error('error-password-same-as-current', 'Entered password same as current password', {\n\t\t\t\t\tmethod: 'saveUserProfile',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (user?.services?.passwordHistory && !(await compareUserPasswordHistory(user, { plain: settings.newPassword }))) {\n\t\t\t\tthrow new Meteor.Error('error-password-in-history', 'Entered password has been previously used', {\n\t\t\t\t\tmethod: 'saveUserProfile',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tpasswordPolicy.validate(settings.newPassword);\n\n\t\t\tawait Accounts.setPasswordAsync(this.userId, settings.newPassword, {\n\t\t\t\tlogout: false,\n\t\t\t});\n\n\t\t\tif (user.requirePasswordChange) {\n\t\t\t\tawait Users.unsetRequirePasswordChange(user._id);","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/users/saveUserProfile.ts#L109-L145","documentation":"Password self-service guard inside saveUserProfile: when settings.newPassword is set, Accounts_AllowPasswordChange is true, and the user has a bcrypt password, the server compares the new password against the current hash via compareUserPassword. A match means the user submitted their existing password as the 'new' one and the change is refused before passwordPolicy.validate or Accounts.setPasswordAsync run.","triggerScenarios":"settings.newPassword === current password for a password-authenticated user with Accounts_AllowPasswordChange=true; OAuth-only users without services.password.bcrypt never reach this check.","commonSituations":"Change-password forms where the user retypes the old password into the new-password field; forms that pre-fill the new password; automated flows that 'reset' to the same password.","solutions":["Compare the new-password field against the current-password field client-side and block identical values","Catch error-password-same-as-current and show 'New password must be different from your current password'","Clear the new-password field after a failed attempt so resubmission cannot reuse the value"],"exampleFix":"// before\nif (newPassword) Meteor.call('saveUserProfile', { newPassword }, customFields);\n\n// after\nif (newPassword && newPassword === currentPassword) {\n  showError('New password must differ from the current one');\n} else {\n  Meteor.call('saveUserProfile', { newPassword }, customFields);\n}","handlingStrategy":"validation","validationCode":"if (newPassword && currentPassword && newPassword === currentPassword) {\n  throw new Error('New password must differ from the current password');\n}","typeGuard":null,"tryCatchPattern":"catch (err) {\n  if (err instanceof Meteor.Error && err.error === 'error-password-same-as-current') {\n    showFieldError('newPassword', 'Choose a password you have not used before');\n    clearField('newPassword');\n  }\n}","preventionTips":["Require distinct current/new password fields client-side before submit","Never pre-fill the new-password field","Clear new-password inputs after failed attempts so resubmits cannot repeat the value"],"tags":["meteor","password","account","profile"],"backgroundTag":"password-policy-violation","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}