{"record":{"id":"f8fe5b39c8629e6a","repo":"apache/cassandra","slug":"error-invalid-password-hash-encountered-rejectin","errorCode":null,"errorMessage":"Error: invalid password hash encountered, rejecting user","messagePattern":"Error: invalid password hash encountered, rejecting user","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/auth/PasswordAuthenticator.java","lineNumber":161,"sourceCode":"            return entries;\n        };\n    }\n\n    public CredentialsCache getCredentialsCache()\n    {\n        return cache;\n    }\n\n    protected static boolean checkpw(String password, String hash)\n    {\n        try\n        {\n            return BCrypt.checkpw(password, hash);\n        }\n        catch (Exception e)\n        {\n            // Improperly formatted hashes may cause BCrypt.checkpw to throw, so trap any other exception as a failure\n            logger.warn(\"Error: invalid password hash encountered, rejecting user\", e);\n            return false;\n        }\n    }\n\n    /**\n     * This is exposed so we can override the consistency level for tests that are single node\n     */\n    @VisibleForTesting\n    UntypedResultSet process(String query, ConsistencyLevel cl)\n    {\n        return QueryProcessor.process(query, cl);\n    }\n\n    private AuthenticatedUser authenticate(String username, String password) throws AuthenticationException\n    {\n        String hash = cache.get(username);\n\n        // intentional use of object equality","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/PasswordAuthenticator.java#L143-L179","documentation":"During login, PasswordAuthenticator.checkpw compares the supplied password against the stored bcrypt hash. BCrypt.checkpw throws on improperly formatted or corrupt hashes; this catch-all traps any such exception, logs a warning, and rejects the user by returning false instead of propagating an exception. Authentication fails for that user only.","triggerScenarios":"A row in system_auth.roles contains a salted_hash that is null, empty, truncated, not a bcrypt hash ($2a$/$2b$ prefix missing), or otherwise corrupt when authenticate() calls checkpw for that role.","commonSituations":"Role created/modified outside normal CQL (manual inserts into system_auth), failed migration between clusters, hand-copied auth tables where the hash was mangled, restoring only part of system_auth, or a password containing characters that broke an external provisioning script.","solutions":["Re-create or ALTER the role to reset its password: ALTER ROLE <user> WITH PASSWORD = '<new>'; or DROP/CREATE ROLE.","Inspect the stored hash: SELECT role, salted_hash FROM system_auth.roles; and confirm it is a valid bcrypt string starting with $2a$ or $2b$.","Re-run the default superuser setup if the affected role is cassandra (node tool or fresh system_auth initialization).","Check provisioning/migration tooling that writes system_auth rows to ensure hashes are produced by the same BCrypt library."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"-- Check stored hashes are valid bcrypt strings before blaming the client\nSELECT role, salted_hash, can_login FROM system_auth.roles;\n-- salted_hash should match '^\\\\$2[aby]\\\\$\\\\d{2}\\\\$.{53}$'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only create/modify roles via CQL (CREATE/ALTER ROLE), never manual system_auth inserts.","Copy or migrate system_auth tables whole, not partially.","When provisioning users programmatically, generate hashes with the same BCrypt version Cassandra uses.","On login failures, check the hash format first before resetting credentials."],"tags":["authentication","bcrypt","password-hash","cql"],"backgroundTag":"invalid-password-hash","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}