makeplane/plane · error · AuthenticationException

5021

5021

Error message

PASSWORD_TOO_WEAK

What it means

validate_password runs zxcvbn on self.code (the credential being validated) and requires a score >= 3 (out of 4). Below 3 is 'PASSWORD_TOO_WEAK' (code 5021). Note the parameter is named 'email' but the code checks self.code — a naming inconsistency, but the behavior is password-strength enforcement.

Source

Thrown at apps/api/plane/authentication/adapter/base.py:95

        # validate email
        try:
            validate_email(email)
        except ValidationError:
            self.logger.warning("Email is not valid")
            raise AuthenticationException(
                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
                error_message="INVALID_EMAIL",
                payload={"email": email},
            )
        # Return email
        return email

    def validate_password(self, email):
        """Validate password strength"""
        results = zxcvbn(self.code)
        if results["score"] < 3:
            self.logger.warning("Password is not strong enough")
            raise AuthenticationException(
                error_code=AUTHENTICATION_ERROR_CODES["PASSWORD_TOO_WEAK"],
                error_message="PASSWORD_TOO_WEAK",
                payload={"email": email},
            )
        return

    def __check_signup(self, email):
        """Check if sign up is enabled or not and raise exception if not enabled"""

        # Get configuration value
        (ENABLE_SIGNUP,) = get_configuration_value([
            {"key": "ENABLE_SIGNUP", "default": os.environ.get("ENABLE_SIGNUP", "1")}
        ])

        # Check if sign up is disabled and invite is present or not
        if ENABLE_SIGNUP == "0" and not WorkspaceMemberInvite.objects.filter(email=email).exists():
            self.logger.warning("Sign up is disabled and invite is not present")
            # Raise exception

View on GitHub (pinned to 1c8a60f858)

Solutions

1. Choose a longer, mixed-character, non-dictionary password (passphrase style).
2. Use a generated password from a password manager.
3. If integrating, surface code 5021 as 'Password too weak — add length/variety' and show zxcvbn feedback inline as the user types.

Example fix

// before
await sdk.signUp({ email, password: 'password123' });

// after
await sdk.signUp({ email, password: generatedPassphrase }); // e.g. 'correct-horse-battery-staple-9'

// client-side strength check mirroring zxcvbn >= 3
import { zxcvbn } from '@zxcvbn-ts/core';
if (zxcvbn(password).score < 3) { setError('Password too weak'); return; }

function isStrongEnough(pw: string): boolean { return zxcvbn(pw).score >= 3; }

try:
    adapter.validate_password(password)
except AuthenticationException as e:
    if e.error_code == 5021:
        return bad_request('Choose a stronger password')
    raise

When it happens

Trigger: Sign-up or password change where the chosen password scores 0-2 in zxcvbn: common passwords, short passwords, dictionary words, passwords closely tied to other known user fields.

Common situations: User picks 'password', '12345678', their email-derivable string, or a short lowercase word; zxcvbn scoring stricter than the user expects.

Related errors

• Password is too common please set a complex password
• 5005
• 5015
• AUTH_USER_MISMATCH
• Authentication unsuccessful

AI-assisted analysis of makeplane/plane@1c8a60f858 (2026-08-12). Data as JSON: /api/errors/420a5e16fda5822d. Report an issue: GitHub.