{"record":{"id":"de8d283ca8b19a58","repo":"louislam/uptime-kuma","slug":"incorrect-current-password","errorCode":null,"errorMessage":"Incorrect current password","messagePattern":"Incorrect current password","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"server/util-server.js","lineNumber":666,"sourceCode":"};\n\n/**\n * For logged-in users, double-check the password\n * @param {Socket} socket Socket.io instance\n * @param {string} currentPassword Password to validate\n * @returns {Promise<Bean>} User\n * @throws The current password is not a string\n * @throws The provided password is not correct\n */\nexports.doubleCheckPassword = async (socket, currentPassword) => {\n    if (typeof currentPassword !== \"string\") {\n        throw new Error(\"Wrong data type?\");\n    }\n\n    let user = await R.findOne(\"user\", \" id = ? AND active = 1 \", [socket.userID]);\n\n    if (!user || !passwordHash.verify(currentPassword, user.password)) {\n        throw new Error(\"Incorrect current password\");\n    }\n\n    return user;\n};\n\n/**\n * Convert unknown string to UTF8\n * @param {Uint8Array} body Buffer\n * @returns {string} UTF8 string\n */\nexports.convertToUTF8 = (body) => {\n    const guessEncoding = chardet.detect(body);\n    const str = iconv.decode(body, guessEncoding);\n    return str.toString();\n};\n\n/**\n * Returns a color code in hex format based on a given percentage:","sourceCodeStart":648,"sourceCodeEnd":684,"githubUrl":"https://github.com/louislam/uptime-kuma/blob/6b5ea0155793e666666745fb8d6fef1e829543a2/server/util-server.js#L648-L684","documentation":"Thrown by exports.doubleCheckPassword(socket, currentPassword) in util-server.js when either the active user lookup fails (`R.findOne(\"user\", \" id = ? AND active = 1 \", [socket.userID])` returns null) or `passwordHash.verify(currentPassword, user.password)` returns false. Used as a second factor for sensitive operations (disable 2FA, delete account, change password, disable auth). Note a separate `typeof currentPassword !== \"string\"` check throws \"Wrong data type?\" first.","triggerScenarios":"Any sensitive socket event in server.js (lines 550-1510) that awaits doubleCheckPassword: disabling 2FA, account deletion, password change, disabling authentication. Triggered when the user mistypes the current password, or when the user account is inactive (active = 0) at the moment of the request.","commonSituations":"User enters an old password after a recent change; password autofill supplies the wrong vault entry; account was deactivated by an admin between login and the sensitive action; corrupted or migrated password hash that no longer verifies; caps-lock or locale/IME producing different characters.","solutions":["Confirm the current password with the user before submitting; show a clear error if it fails.","Ensure the user account is active (active = 1) — reactivate via DB/admin if deactivated.","If hash verification fails for all users after a migration, rehash using the same algorithm/bcrypt cost.","Rate-limit password-confirmation attempts to prevent brute force."],"exampleFix":"// before\nawait doubleCheckPassword(socket, currentPassword); // mistyped -> throws\n\n// after\nif (typeof currentPassword !== \"string\" || !currentPassword) {\n  throw new Error(\"Current password is required\");\n}\ntry {\n  await doubleCheckPassword(socket, currentPassword);\n} catch (e) {\n  // surface \"Incorrect current password\" to the user, do NOT proceed\n  throw e;\n}","handlingStrategy":"try-catch","validationCode":"if (typeof currentPassword !== \"string\" || !currentPassword) throw new Error(\"Current password required\");","typeGuard":"const isNonEmptyPassword = (v) => typeof v === \"string\" && v.length > 0;","tryCatchPattern":"try { await doubleCheckPassword(socket, currentPassword); } catch (e) { if (e.message === \"Incorrect current password\") { showUserError(); return; } throw e; }","preventionTips":["Prompt for the current password explicitly before sensitive actions.","Ensure the user account is active.","Rate-limit confirmation attempts to avoid brute force."],"tags":["auth","password","security","socket","uptime-kuma"],"backgroundTag":null,"analyzedSha":"6b5ea0155793e666666745fb8d6fef1e829543a2","analyzedAt":"2026-08-12T23:42:12.959Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}