open-webui/open-webui · warning · HTTPException

The email or password provided is incorrect. Please check fo

Error message

The email or password provided is incorrect. Please check for typos and try logging in again.

What it means

400 INVALID_CRED ('email or password ... incorrect') from the profile-update endpoint: `Auths.authenticate_user(session_user.email, verify_password(form_data.password))` returned falsy. Users must re-supply their current password to change profile fields; a mismatch (wrong password, password changed elsewhere, or auth record stored differently) yields this generic credentials error rather than a password-specific one.

Source

Thrown at backend/open_webui/routers/auths.py:341

    if session_user:
        user = await Users.update_user_by_id(
            session_user.id,
            form_data.model_dump(),
            db=db,
        )
        if user:
            await publish_event(
                request,
                EVENTS.USER_PROFILE_UPDATED,
                actor=session_user,
                subject_id=session_user.id,
                data={'updated_fields': list(form_data.model_dump().keys())},
            )
            return user
        else:
            raise HTTPException(400, detail=ERROR_MESSAGES.DEFAULT())
    else:
        raise HTTPException(400, detail=ERROR_MESSAGES.INVALID_CRED)


############################
# Update Timezone
############################


class UpdateTimezoneForm(BaseModel):
    timezone: str


@router.post('/update/timezone')
async def update_timezone(
    request: Request,
    form_data: UpdateTimezoneForm,
    session_user=Depends(get_current_user),
    db: AsyncSession = Depends(get_async_session),
):

View on GitHub (pinned to 01f4282f1f)

Solutions

1. Re-enter the current account password in the confirmation field of the profile editor.
2. If the password was forgotten, use admin-initiated password reset (Admin Panel > Users > reset) instead of guessing.
3. For LDAP/OAuth-managed accounts, update the profile fields that do not require password confirmation, or have the admin adjust them.
4. Check for leading/trailing spaces or autofill artifacts in the submitted password field.

# Client-side pre-check: only submit when a fresh password was typed
function canSubmitProfileForm(password: string): boolean {
  return password.trim().length > 0; // server will still verify the hash
}

from fastapi import HTTPException
try:
    resp = await client.post('/api/v1/auths/update/profile', json=payload)
except HTTPException as e:
    if e.status_code == 400 and 'email or password' in str(e.detail).lower():
        # wrong CURRENT password: prompt user, never auto-retry with same value
        show_inline_error('Re-enter your current password')
    raise

When it happens

Trigger: POST /api/v1/auths/update/profile where the 'password' form field does not verify against the stored bcrypt/passlib hash for the session user's email — typo, stale password after a recent change on another device, or copy-paste with whitespace.

Common situations: Users who recently rotated passwords using an old cached form; password managers autocompleting an outdated entry; accounts provisioned via LDAP/OAuth where no local password exists, so any supplied password fails verification.

Related errors

• The password provided is incorrect. Please check for typos a
• Something went wrong :/
• The requested action has been restricted as a security measu
• Mistral API key is required for Mistral STT
• Audio conversion failed. The audio file may be corrupted or

AI-assisted analysis of open-webui/open-webui@01f4282f1f (2026-08-14). Data as JSON: /api/errors/61f21d35eaecdf7a. Report an issue: GitHub.