{"record":{"id":"e7d5778784c5f095","repo":"bitwarden/server","slug":"user-verification-failed-e7d577","errorCode":null,"errorMessage":"User verification failed.","messagePattern":"User verification failed\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Api/Auth/Controllers/WebAuthnController.cs","lineNumber":187,"sourceCode":"    }\n\n    private async Task<Core.Entities.User> GetUserAsync()\n    {\n        var user = await _userService.GetUserByPrincipalAsync(User);\n        if (user == null)\n        {\n            throw new UnauthorizedAccessException();\n        }\n        return user;\n    }\n\n    private async Task<Core.Entities.User> VerifyUserAsync(SecretVerificationRequestModel model)\n    {\n        var user = await GetUserAsync();\n        if (!await _userService.VerifySecretAsync(user, model.Secret))\n        {\n            await Task.Delay(Constants.FailedSecretVerificationDelay);\n            throw new BadRequestException(string.Empty, \"User verification failed.\");\n        }\n\n        return user;\n    }\n}\n","sourceCodeStart":169,"sourceCodeEnd":193,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Api/Auth/Controllers/WebAuthnController.cs#L169-L193","documentation":"Thrown (HTTP 400, model-state error under an empty key) by VerifyUserAsync when _userService.VerifySecretAsync(user, model.Secret) returns false. A deliberate Constants.FailedSecretVerificationDelay is awaited before throwing to throttle brute-force attempts on the master password / OTP.","triggerScenarios":"Incorrect master password supplied; incorrect OTP code; the user's KDF/hash parameters changed and the client is hashing against stale parameters; password typed for a different account.","commonSituations":"Caps-lock or wrong keyboard layout; stale vault session still using an old password after a password change; user logged into the wrong account; clock drift invalidating TOTP.","solutions":["Re-enter the correct master password or current OTP code.","If the password was recently changed, ensure the client has refreshed credentials before retrying.","Use account recovery if the master password is genuinely forgotten."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// VerifySecretAsync cannot be safely pre-validated client-side (the secret must be checked server-side).\n// Wrap the call and, on verification failure, re-prompt without leaking whether the user exists.\ntry {\n  await post('/webauthn/{id}/delete', { secret });\n} catch (e) {\n  if (e.isBadRequest && e.modelState?.['']?.includes('User verification failed.')) {\n    showSecretPrompt('Incorrect master password or OTP. Try again.');\n  } else { throw e; }\n}","preventionTips":["Clear and re-type the master password rather than retrying a cached value after changes.","Sync the client to the current password before secret-verified operations.","Do not brute-force: repeated failures may trigger account protection."],"tags":["authentication","verification","master-password","throttle","brute-force"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}