invoke-ai/InvokeAI · error · HTTPException

Current password is required to set a new password

Error message

Current password is required to set a new password

What it means

update_current_user requires the current password whenever a new password is requested. If PATCH /auth/me includes new_password but omits current_password, the endpoint raises 400 'Current password is required to set a new password'. This is a re-authentication guard preventing session hijackers from silently changing the password.

Source

Thrown at invokeai/app/api/routers/auth.py:734

        request: Profile fields to update
        current_user: The authenticated user
        http_request: The HTTP request, used to scope the replacement media cookie
        response: The HTTP response, used to return the replacement token

    Returns:
        The updated user

    Raises:
        HTTPException: 400 if current password is incorrect or new password is weak
        HTTPException: 404 if user not found
    """
    user_service = ApiDependencies.invoker.services.users
    config = ApiDependencies.invoker.services.configuration

    # Verify current password when attempting a password change
    if request.new_password is not None:
        if not request.current_password:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="Current password is required to set a new password",
            )

        # Re-authenticate to verify the current password
        user = user_service.get(current_user.user_id)
        if user is None:
            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")

        authenticated = user_service.authenticate(user.email, request.current_password)
        if authenticated is None:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail="Current password is incorrect",
            )

    try:
        changes = UserUpdateRequest(

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Include current_password in the PATCH body whenever new_password is set
2. Fix the client form so the current-password field is required and validated before submit
3. If you only want to change username/email, omit new_password entirely

Example fix

// before
api.patch('/auth/me', { new_password: 'hunter2' }); // 400
// after
api.patch('/auth/me', { new_password: 'hunter2', current_password: 'oldPass' });

if (payload.new_password && !payload.current_password) {
  throw new Error('current_password is required when changing the password');
}
await api.patch('/auth/me', payload);

function hasPasswordChange(p): p is { new_password: string; current_password: string } {
  return typeof p.new_password === 'string' && typeof p.current_password === 'string' && p.current_password.length > 0;
}

try {
  await api.patch('/auth/me', payload);
} catch (e) {
  if (e.response?.status === 400 && e.response?.data?.detail?.includes('Current password is required')) {
    promptForCurrentPassword();
  } else throw e;
}

When it happens

Trigger: PATCH /auth/me (update_current_user) with a body containing new_password set but current_password null/empty/missing.

Common situations: Client form only sends changed fields and treats current_password as optional; password-manager autofill skipping the current-password field; API consumers assuming password change needs no re-auth.

Related errors

• str(e)
• No external provider config fields provided
• Administrator account already configured
• The system user cannot be deleted, deactivated, promoted to
• Cannot remove the last administrator

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/9f9bccb7dd268d16. Report an issue: GitHub.