bitwarden/server · error · BadRequestException
User verification failed.
Error message
User verification failed.
What it means
Thrown (HTTP 400, model-state error under an empty key) by VerifyUserAsync when _userService.VerifySecretAsync(user, model.Secret) returns false. A deliberate Constants.FailedSecretVerificationDelay is awaited before throwing to throttle brute-force attempts on the master password / OTP.
Source
Thrown at src/Api/Auth/Controllers/WebAuthnController.cs:187
}
private async Task<Core.Entities.User> GetUserAsync()
{
var user = await _userService.GetUserByPrincipalAsync(User);
if (user == null)
{
throw new UnauthorizedAccessException();
}
return user;
}
private async Task<Core.Entities.User> VerifyUserAsync(SecretVerificationRequestModel model)
{
var user = await GetUserAsync();
if (!await _userService.VerifySecretAsync(user, model.Secret))
{
await Task.Delay(Constants.FailedSecretVerificationDelay);
throw new BadRequestException(string.Empty, "User verification failed.");
}
return user;
}
}
View on GitHub (pinned to e93b962371)
Solutions
- Re-enter the correct master password or current OTP code.
- If the password was recently changed, ensure the client has refreshed credentials before retrying.
- Use account recovery if the master password is genuinely forgotten.
Defensive patterns
Strategy: try-catch
Try / catch
// VerifySecretAsync cannot be safely pre-validated client-side (the secret must be checked server-side).
// Wrap the call and, on verification failure, re-prompt without leaking whether the user exists.
try {
await post('/webauthn/{id}/delete', { secret });
} catch (e) {
if (e.isBadRequest && e.modelState?.['']?.includes('User verification failed.')) {
showSecretPrompt('Incorrect master password or OTP. Try again.');
} else { throw e; }
} Prevention
- Clear and re-type the master password rather than retrying a cached value after changes.
- Sync the client to the current password before secret-verified operations.
- Do not brute-force: repeated failures may trigger account protection.
When it happens
Trigger: Incorrect master password supplied; incorrect OTP code; the user's KDF/hash parameters changed and the client is hashing against stale parameters; password typed for a different account.
Common situations: Caps-lock or wrong keyboard layout; stale vault session still using an old password after a password change; user logged into the wrong account; clock drift invalidating TOTP.
Related errors
AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13).
Data as JSON: /api/errors/e7d5778784c5f095.
Report an issue: GitHub.