bitwarden/server · error · BadRequestException

User verification failed.

Error message

User verification failed.

What it means

Error "User verification failed." thrown in bitwarden/server.

Source

Thrown at src/Api/Vault/Controllers/CiphersController.cs:1294

    public async Task<ListResponseModel<CipherMiniResponseModel>> PostShareMany([FromBody] CipherBulkShareRequestModel model)
    {
        return await PutShareMany(model);
    }

    [HttpPost("purge")]
    public async Task PostPurge([FromBody] SecretVerificationRequestModel model, Guid? organizationId = null)
    {
        var user = await _userService.GetUserByPrincipalAsync(User);
        if (user == null)
        {
            throw new UnauthorizedAccessException();
        }

        if (!await _userService.VerifySecretAsync(user, model.Secret))
        {
            ModelState.AddModelError(string.Empty, "User verification failed.");
            await Task.Delay(2000);
            throw new BadRequestException(ModelState);
        }

        if (organizationId == null)
        {
            // Check if the user is claimed by any organization.
            if (await _userService.IsClaimedByAnyOrganizationAsync(user.Id))
            {
                throw new BadRequestException(new CannotPurgeClaimedAccountError().Message);
            }
            await _cipherRepository.DeleteByUserIdAsync(user.Id);
        }
        else
        {
            if (!await _currentContext.EditAnyCollection(organizationId!.Value))
            {
                throw new NotFoundException();
            }
            await _cipherService.PurgeAsync(organizationId!.Value);

View on GitHub (pinned to e93b962371)

Solutions

1. Re-enter your master password when prompted to verify your identity, then retry.
2. Complete any required two-factor verification before retrying the sensitive operation.
3. Sign out and back in to obtain a fresh session token if the session has expired.

When it happens

Trigger: Thrown when user verification (password or OTP) fails before a sensitive cipher operation such as purge or attachment access.

Common situations: See trigger scenarios.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/40410b5dbc6fb7de. Report an issue: GitHub.