invoke-ai/InvokeAI · error · HTTPException

Current password is incorrect

Error message

Current password is incorrect

What it means

When changing a password, update_current_user re-authenticates with user_service.authenticate(user.email, current_password); a None result means the supplied current password is wrong, and the endpoint raises 400 'Current password is incorrect'.

Source

Thrown at invokeai/app/api/routers/auth.py:746

    user_service = ApiDependencies.invoker.services.users
    config = ApiDependencies.invoker.services.configuration

    # Verify current password when attempting a password change
    if request.new_password is not None:
        if not request.current_password:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="Current password is required to set a new password",
            )

        # Re-authenticate to verify the current password
        user = user_service.get(current_user.user_id)
        if user is None:
            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")

        authenticated = user_service.authenticate(user.email, request.current_password)
        if authenticated is None:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="Current password is incorrect",
            )

    try:
        changes = UserUpdateRequest(
            display_name=request.display_name,
            password=request.new_password,
        )
        updated = user_service.update(
            current_user.user_id, changes, strict_password_checking=config.strict_password_checking
        )
    except ValueError as e:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)) from e

    if request.new_password is not None:
        # Drop the account's other live sockets. They authenticated under the superseded
        # epoch and would otherwise keep streaming this user's events even though every

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Re-enter the correct current password and retry
2. If the current password is forgotten, use the password reset flow instead of PATCH /auth/me
3. Confirm the password manager has the latest saved password (or type it manually)

Example fix

// before
api.patch('/auth/me', { new_password: 'new', current_password: 'wrongOld' }); // 400
// after
const ok = confirmCurrentPasswordWithUser(); // prompt again
if (ok) api.patch('/auth/me', { new_password: 'new', current_password: ok });

try {
  await api.patch('/auth/me', { new_password, current_password });
} catch (e) {
  if (e.response?.status === 400 && e.response?.data?.detail === 'Current password is incorrect') {
    rePromptForCurrentPassword();
  } else throw e;
}

When it happens

Trigger: PATCH /auth/me with new_password and a current_password value that does not match the stored password hash for the authenticated user.

Common situations: Typo in the current password; password changed in another tab/device so the user's memory is stale; password manager autofilling an outdated password; confusion with an SSO password vs local password.

Related errors

• Current password is required to set a new password
• No external provider config fields provided
• Multiuser mode is disabled. Authentication is not required i
• Incorrect email or password
• User account is disabled

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/30e88063c185ecac. Report an issue: GitHub.