jellyfin/jellyfin · error · SecurityException

The {user.Username} account is currently disabled. Please co

Error message

The {user.Username} account is currently disabled. Please consult with your administrator.

What it means

Thrown when a disabled account attempts login. Defensive fix: check the disabled flag before password verification order is fixed, return 403 with a neutral message, and audit-log the attempt; ensure disabled users' existing sessions/tokens are revoked.

Source

Thrown at Jellyfin.Server.Implementations/Users/UserManager.cs:584

                    }
                }

                if (user is null)
                {
                    _logger.LogInformation(
                        "Authentication request for {UserName} has been denied (IP: {IP}).",
                        username,
                        remoteEndPoint);
                    throw new AuthenticationException("Invalid username or password entered.");
                }

                if (user.HasPermission(PermissionKind.IsDisabled))
                {
                    _logger.LogInformation(
                        "Authentication request for {UserName} has been denied because this account is currently disabled (IP: {IP}).",
                        username,
                        remoteEndPoint);
                    throw new SecurityException(
                        $"The {user.Username} account is currently disabled. Please consult with your administrator.");
                }

                if (!user.HasPermission(PermissionKind.EnableRemoteAccess) &&
                    !_networkManager.IsInLocalNetwork(remoteEndPoint))
                {
                    _logger.LogInformation(
                        "Authentication request for {UserName} forbidden: remote access disabled and user not in local network (IP: {IP}).",
                        username,
                        remoteEndPoint);
                    throw new SecurityException("Forbidden.");
                }

                if (!user.IsParentalScheduleAllowed())
                {
                    _logger.LogInformation(
                        "Authentication request for {UserName} is not allowed at this time due parental restrictions (IP: {IP}).",
                        username,

View on GitHub (pinned to ae8723026d)

Solutions

1. Have an administrator re-enable the account in Dashboard > Users.
2. Sign in with a different, enabled account.

Example fix

user.SetPermission(PermissionKind.IsDisabled, false); await _userManager.UpdateUserAsync(user);

When it happens

Trigger: Thrown at Jellyfin.Server.Implementations/Users/UserManager.cs:584 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of jellyfin/jellyfin@ae8723026d (2026-08-13). Data as JSON: /api/errors/99ac5745cc3d8f30. Report an issue: GitHub.