jellyfin/jellyfin · error · SecurityException

User account has been disabled.

Error message

User account has been disabled.

What it means

Thrown by AuthService.Authenticate when the resolved auth.User has the IsDisabled permission flag set (HasPermission returns true, with a null-safe coalesce). It is a SecurityException and fires only after the token is validated as authentic, so it indicates an explicitly disabled account, not a bad token.

Source

Thrown at Emby.Server.Implementations/HttpServer/Security/AuthService.cs:37

        }

        public async Task<AuthorizationInfo> Authenticate(HttpRequest request)
        {
            var auth = await _authorizationContext.GetAuthorizationInfo(request).ConfigureAwait(false);

            if (!auth.HasToken)
            {
                return auth;
            }

            if (!auth.IsAuthenticated)
            {
                throw new SecurityException("Invalid token.");
            }

            if (auth.User?.HasPermission(PermissionKind.IsDisabled) ?? false)
            {
                throw new SecurityException("User account has been disabled.");
            }

            return auth;
        }
    }
}

View on GitHub (pinned to ae8723026d)

Solutions

1. Have an administrator re-enable the user account (clear IsDisabled).
2. Surface a clear 'account disabled' message to the end user and direct them to an admin.
3. Do not retry with the same credentials; the failure is intentional policy, not transient.
4. Audit user management to confirm the disable was intended.

Example fix

// before: requests from disabled user throw
// after (admin action)
user.SetPermission(PermissionKind.IsDisabled, false);
await _userManager.UpdateUserAsync(user);

try { await _authService.Authenticate(request); }
catch (SecurityException ex) when (ex.Message.Contains("disabled")) { return Forbid("Account disabled"); }

When it happens

Trigger: An authenticated request from a user account that an administrator has disabled (PermissionKind.IsDisabled).

Common situations: Admin disabled the account after issues; temporary suspension; compromised-account lockdown; migration left accounts in a disabled state.

Related errors

• Invalid token.
• Token is required
• Forbidden
• Can't verify hash with id: {hash.Id}
• Invalid username or password entered.

AI-assisted analysis of jellyfin/jellyfin@ae8723026d (2026-08-13). Data as JSON: /api/errors/580a01c1b15ee7b8. Report an issue: GitHub.