laravel/framework · warning · InvalidArgumentException

The given password does not match the current password.

Error message

The given password does not match the current password.

What it means

Thrown by SessionGuard::rehashUserPasswordForDeviceLogout() (invoked via Auth::logoutOtherDevices($password)) when Hash::check($password, $user->getAuthPassword()) is false. The guard refuses to invalidate other sessions unless the caller proves knowledge of the current password.

Source

Thrown at src/Illuminate/Auth/SessionGuard.php:771

        $this->fireOtherDeviceLogoutEvent($this->user());

        return $result;
    }

    /**
     * Rehash the current user's password for logging out other devices via AuthenticateSession.
     *
     * @param  string  $password
     * @return \Illuminate\Contracts\Auth\Authenticatable|null
     *
     * @throws \InvalidArgumentException
     */
    protected function rehashUserPasswordForDeviceLogout(#[\SensitiveParameter] $password)
    {
        $user = $this->user();

        if (! Hash::check($password, $user->getAuthPassword())) {
            throw new InvalidArgumentException('The given password does not match the current password.');
        }

        $this->provider->rehashPasswordIfRequired(
            $user, ['password' => $password], force: true
        );
    }

    /**
     * Register an authentication attempt event listener.
     *
     * @param  mixed  $callback
     * @return void
     */
    public function attempting($callback)
    {
        $this->events?->listen(Events\Attempting::class, $callback);
    }

View on GitHub (pinned to bd6b5437e6)

Solutions

1. Validate the password against the user before calling logoutOtherDevices().
2. Show a clear 'current password incorrect' message in the form UI.
3. Ensure the password column is hashed with the configured hasher (config/hashing.php).
4. Catch InvalidArgumentException to render a friendly validation error.

Example fix

// before
Auth::logoutOtherDevices($request->input('password'));
// throws InvalidArgumentException on mismatch

// after
$validated = $request->validate([
    'password' => ['required', function ($attr, $value, $fail) {
        if (! \Illuminate\Support\Facades\Hash::check($value, auth()->user()->getAuthPassword())) {
            $fail('The current password is incorrect.');
        }
    }],
]);
Auth::logoutOtherDevices($validated['password']);

$password = $request->input('password');
if (! \Illuminate\Support\Facades\Hash::check($password, Auth::user()->getAuthPassword())) {
    return back()->withErrors(['password' => 'The current password is incorrect.']);
}
Auth::logoutOtherDevices($password);

function currentPasswordMatches(string $password): bool
{
    return Hash::check($password, Auth::user()->getAuthPassword());
}

try {
    Auth::logoutOtherDevices($request->input('password'));
} catch (\InvalidArgumentException $e) {
    return back()->withErrors(['password' => $e->getMessage()]);
}

When it happens

Trigger: Calling Auth::logoutOtherDevices($password) with a password that does not match the authenticated user's stored hash.

Common situations: User typed the wrong 'current password' in a 'log out other devices' form; the password was changed elsewhere; the user model's getAuthPassword() returns a non-bcrypt/argon column.

Related errors

• Cookie jar has not been set.
• Auth guard [{$name}] is not defined.
• Auth driver [{$config['driver']}] for guard [{$name}] is not
• Unable to bind custom driver callback
• Authentication user provider [{$driver}] is not defined.

AI-assisted analysis of laravel/framework@bd6b5437e6 (2026-08-06). Data as JSON: /data/errors/ef55a24d33ab9159.json. Report an issue: GitHub.