bitwarden/server · error · BadRequestException

Master Password reset is required, but not provided.

Error message

Master Password reset is required, but not provided.

What it means

Error "Master Password reset is required, but not provided." thrown in bitwarden/server.

Source

Thrown at src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:371

    {
        var user = await _userService.GetUserByPrincipalAsync(User);
        if (user == null)
        {
            throw new UnauthorizedAccessException();
        }

        var organizationUser = await _organizationUserRepository.GetByIdAsync(organizationUserId);
        if (organizationUser == null || organizationUser.OrganizationId != orgId)
        {
            throw new NotFoundException("Organization user mismatch");
        }

        var autoEnrollEnabled = (await _policyRequirementQuery.GetAsync<ResetPasswordPolicyRequirement>(user.Id))
            .AutoEnrollEnabled(orgId);

        if (autoEnrollEnabled && !OrganizationUser.IsValidResetPasswordKey(model.ResetPasswordKey))
        {
            throw new BadRequestException("Master Password reset is required, but not provided.");
        }

        await _acceptOrgUserCommand.AcceptOrgUserByEmailTokenAsync(organizationUserId, user, model.Token, _userService);

        if (autoEnrollEnabled)
        {
            await _updateUserResetPasswordEnrollmentCommand.UpdateUserResetPasswordEnrollmentAsync(orgId, user.Id, model.ResetPasswordKey, user.Id);
        }
    }

    [HttpPost("{id}/confirm")]
    [Authorize<ManageUsersRequirement>]
    public async Task Confirm(Guid orgId, Guid id, [FromBody] OrganizationUserConfirmRequestModel model)
    {
        var userId = _userService.GetProperUserId(User);
        _ = await _confirmOrganizationUserCommand.ConfirmUserAsync(orgId, id, model.Key, userId.Value, model.DefaultUserCollectionName);
    }

View on GitHub (pinned to e93b962371)

Solutions

1. Include the MasterPasswordHash (or the reset password key) in the request when performing a master password reset.
2. Use the client workflow for admin password reset, which supplies the required reset payload automatically.

When it happens

Trigger: Thrown when an admin-initiated account recovery requires a master password reset for the target user but the request does not include the new master password hash.

Common situations: See trigger scenarios.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/febc9a1d873e55d8. Report an issue: GitHub.