mem0ai/mem0 · error · HTTPException

Current password is incorrect.

Error message

Current password is incorrect.

What it means

Raised by POST /auth/change-password when db.get(User, user.id) fails or verify_password(body.current_password, db_user.password_hash) returns False — i.e. the account no longer exists or the supplied current password does not match the stored hash. The server deliberately returns one 401 message for both conditions rather than distinguishing them.

Source

Thrown at server/routers/auth.py:207

        if collision is not None:
            raise HTTPException(status_code=409, detail="Email is already in use.")
        db_user.email = body.email

    db.commit()
    return db_user


@router.post("/change-password", response_model=MessageResponse)
def change_password(
    body: ChangePasswordRequest,
    user: User = Depends(require_auth),
    db: Session = Depends(get_db),
):
    # require_auth resolves the user in its own short-lived session, so `user` is
    # detached from this request's `db`. Load a session-managed copy to mutate.
    db_user = db.get(User, user.id)
    if db_user is None or not verify_password(body.current_password, db_user.password_hash):
        raise HTTPException(status_code=401, detail="Current password is incorrect.")

    _require_password_length(body.new_password)

    db_user.password_hash = hash_password(body.new_password)
    db.commit()
    return MessageResponse(message="Password updated.")


@router.post("/onboarding-complete", response_model=MessageResponse)
def onboarding_complete(body: OnboardingCompleteRequest, user: User = Depends(require_auth)):
    """Fire the one-shot telemetry event after the setup wizard reaches its success state."""
    capture_onboarding_completed(email=user.email, use_case=body.use_case)
    return MessageResponse(message="Onboarding completed.")

View on GitHub (pinned to 001c235229)

Solutions

1. Confirm current_password exactly matches the account's existing password (check for stray whitespace/newlines in the payload)
2. If the password was changed in another session, re-enter the new current password or use password reset
3. If the account was deleted, no fix is possible — re-register and log in again

Example fix

// before
await post("/auth/change-password", { current_password: formData.pass, new_password: formData.newPass }); // typo in current

// after
const pw = formData.currentPassword.trim(); // only if your product trims; otherwise ensure exact input
await post("/auth/change-password", { current_password: pw, new_password: formData.newPassword });

// cheap client-side sanity checks before the call
if (!formData.currentPassword) throw new Error("Current password is required");
if (formData.newPassword.length < minPasswordLength) throw new Error("New password too short");

catch (e) {
  if (e.status === 401 && e.detail === "Current password is incorrect.") {
    showFieldError("currentPassword", "Incorrect current password");
    return;
  }
  throw e;
}

When it happens

Trigger: POST /auth/change-password with a wrong current_password; account deleted between authentication and the handler (db_user is None); password was changed in another session/tab after this client's token was issued, so the old password no longer verifies.

Common situations: User typos the current password; password recently rotated elsewhere and the client form holds the stale one; copy/paste with trailing whitespace in the password field; user row removed by an admin mid-session.

Related errors

• Authentication failed. Your API key may be invalid or expire
• Resource not found: ${path}
• Bad request to ${path}: ${detail}
• Either memoryId or --all is required
• Resource not found: ${path}

AI-assisted analysis of mem0ai/mem0@001c235229 (2026-08-15). Data as JSON: /api/errors/bbc096f7cf3cbaef. Report an issue: GitHub.