bitwarden/server · error · BadRequestException

Incorrect password

Error message

Incorrect password

What it means

Error "Incorrect password" thrown in bitwarden/server.

Source

Thrown at src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:538

            .ToList();

        return collectionAccessToSave;
    }

    [HttpPut("{userId}/reset-password-enrollment")]
    public async Task PutResetPasswordEnrollment(Guid orgId, Guid userId, [FromBody] OrganizationUserResetPasswordEnrollmentRequestModel model)
    {
        var user = await _userService.GetUserByPrincipalAsync(User);
        if (user == null)
        {
            throw new UnauthorizedAccessException();
        }

        var ssoConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(orgId);
        var isTdeEnrollment = ssoConfig != null && ssoConfig.Enabled && ssoConfig.GetData().MemberDecryptionType == MemberDecryptionType.TrustedDeviceEncryption;
        if (!isTdeEnrollment && OrganizationUser.IsValidResetPasswordKey(model.ResetPasswordKey) && !await _userService.VerifySecretAsync(user, model.MasterPasswordHash))
        {
            throw new BadRequestException("Incorrect password");
        }

        var callingUserId = user.Id;
        await _updateUserResetPasswordEnrollmentCommand.UpdateUserResetPasswordEnrollmentAsync(
            orgId, userId, model.ResetPasswordKey, callingUserId);

        var orgUser = await _organizationUserRepository.GetByOrganizationAsync(orgId, user.Id);
        if (orgUser.Status == OrganizationUserStatusType.Invited)
        {
            await _acceptOrgUserCommand.AcceptOrgUserByOrgIdAsync(orgId, user, _userService);
        }
    }

#nullable enable
    [HttpPut("{id}/recover-account")]
    [Authorize<ManageAccountRecoveryRequirement>]
    public async Task<IResult> RecoverAccount(Guid orgId, Guid id, [FromBody] OrganizationUserResetPasswordRequestModel model,
        [InjectOrganizationUser] OrganizationUser targetOrganizationUser)

View on GitHub (pinned to e93b962371)

Solutions

1. Re-enter your master password; this prompt requires your own current password for verification.
2. If you log in with SSO, use the master password you set, or complete the flow from a client that supports your login type.
3. Reset your master password if you have forgotten it, then retry the operation.

When it happens

Trigger: Thrown when the supplied master password fails verification during an operation that requires password confirmation, such as an admin reset or sensitive account action.

Common situations: See trigger scenarios.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/0baafaf5ac031bb3. Report an issue: GitHub.