louislam/uptime-kuma · warning · Error

Incorrect current password

Error message

Incorrect current password

What it means

Thrown by exports.doubleCheckPassword(socket, currentPassword) in util-server.js when either the active user lookup fails (`R.findOne("user", " id = ? AND active = 1 ", [socket.userID])` returns null) or `passwordHash.verify(currentPassword, user.password)` returns false. Used as a second factor for sensitive operations (disable 2FA, delete account, change password, disable auth). Note a separate `typeof currentPassword !== "string"` check throws "Wrong data type?" first.

Source

Thrown at server/util-server.js:666

};

/**
 * For logged-in users, double-check the password
 * @param {Socket} socket Socket.io instance
 * @param {string} currentPassword Password to validate
 * @returns {Promise<Bean>} User
 * @throws The current password is not a string
 * @throws The provided password is not correct
 */
exports.doubleCheckPassword = async (socket, currentPassword) => {
    if (typeof currentPassword !== "string") {
        throw new Error("Wrong data type?");
    }

    let user = await R.findOne("user", " id = ? AND active = 1 ", [socket.userID]);

    if (!user || !passwordHash.verify(currentPassword, user.password)) {
        throw new Error("Incorrect current password");
    }

    return user;
};

/**
 * Convert unknown string to UTF8
 * @param {Uint8Array} body Buffer
 * @returns {string} UTF8 string
 */
exports.convertToUTF8 = (body) => {
    const guessEncoding = chardet.detect(body);
    const str = iconv.decode(body, guessEncoding);
    return str.toString();
};

/**
 * Returns a color code in hex format based on a given percentage:

View on GitHub (pinned to 6b5ea01557)

Solutions

1. Confirm the current password with the user before submitting; show a clear error if it fails.
2. Ensure the user account is active (active = 1) — reactivate via DB/admin if deactivated.
3. If hash verification fails for all users after a migration, rehash using the same algorithm/bcrypt cost.
4. Rate-limit password-confirmation attempts to prevent brute force.

Example fix

// before
await doubleCheckPassword(socket, currentPassword); // mistyped -> throws

// after
if (typeof currentPassword !== "string" || !currentPassword) {
  throw new Error("Current password is required");
}
try {
  await doubleCheckPassword(socket, currentPassword);
} catch (e) {
  // surface "Incorrect current password" to the user, do NOT proceed
  throw e;
}

if (typeof currentPassword !== "string" || !currentPassword) throw new Error("Current password required");

const isNonEmptyPassword = (v) => typeof v === "string" && v.length > 0;

try { await doubleCheckPassword(socket, currentPassword); } catch (e) { if (e.message === "Incorrect current password") { showUserError(); return; } throw e; }

When it happens

Trigger: Any sensitive socket event in server.js (lines 550-1510) that awaits doubleCheckPassword: disabling 2FA, account deletion, password change, disabling authentication. Triggered when the user mistypes the current password, or when the user account is inactive (active = 0) at the moment of the request.

Common situations: User enters an old password after a recent change; password autofill supplies the wrong vault entry; account was deactivated by an admin between login and the sensitive action; corrupted or migrated password hash that no longer verifies; caps-lock or locale/IME producing different characters.

Related errors

• Invalid new password
• You are not logged in.
• The token is invalid due to password change or old token
• Permission denied.
• Slug must be string

AI-assisted analysis of louislam/uptime-kuma@6b5ea01557 (2026-08-12). Data as JSON: /api/errors/de8d283ca8b19a58. Report an issue: GitHub.