bitwarden/server · error · BadRequestException

User verification failed.

Error message

User verification failed.

What it means

Thrown (HTTP 400, model-state error under an empty key) by VerifyUserAsync when _userService.VerifySecretAsync(user, model.Secret) returns false. A deliberate Constants.FailedSecretVerificationDelay is awaited before throwing to throttle brute-force attempts on the master password / OTP.

Source

Thrown at src/Api/Auth/Controllers/WebAuthnController.cs:187

    }

    private async Task<Core.Entities.User> GetUserAsync()
    {
        var user = await _userService.GetUserByPrincipalAsync(User);
        if (user == null)
        {
            throw new UnauthorizedAccessException();
        }
        return user;
    }

    private async Task<Core.Entities.User> VerifyUserAsync(SecretVerificationRequestModel model)
    {
        var user = await GetUserAsync();
        if (!await _userService.VerifySecretAsync(user, model.Secret))
        {
            await Task.Delay(Constants.FailedSecretVerificationDelay);
            throw new BadRequestException(string.Empty, "User verification failed.");
        }

        return user;
    }
}

View on GitHub (pinned to e93b962371)

Solutions

  1. Re-enter the correct master password or current OTP code.
  2. If the password was recently changed, ensure the client has refreshed credentials before retrying.
  3. Use account recovery if the master password is genuinely forgotten.
Defensive patterns

Strategy: try-catch

Try / catch

// VerifySecretAsync cannot be safely pre-validated client-side (the secret must be checked server-side).
// Wrap the call and, on verification failure, re-prompt without leaking whether the user exists.
try {
  await post('/webauthn/{id}/delete', { secret });
} catch (e) {
  if (e.isBadRequest && e.modelState?.['']?.includes('User verification failed.')) {
    showSecretPrompt('Incorrect master password or OTP. Try again.');
  } else { throw e; }
}

Prevention

When it happens

Trigger: Incorrect master password supplied; incorrect OTP code; the user's KDF/hash parameters changed and the client is hashing against stale parameters; password typed for a different account.

Common situations: Caps-lock or wrong keyboard layout; stale vault session still using an old password after a password change; user logged into the wrong account; clock drift invalidating TOTP.

Related errors


AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/e7d5778784c5f095. Report an issue: GitHub.