open-webui/open-webui · warning · HTTPException

The password provided is incorrect. Please check for typos a

Error message

The password provided is incorrect. Please check for typos and try again.

What it means

400 INCORRECT_PASSWORD from update_password: the user record exists and the session is valid, but `Auths.authenticate_user(session_user.email, verify_password(form_data.password))` returned falsy — the supplied CURRENT password does not match the stored hash. Distinct from INVALID_CRED (which covers missing session user); this specifically says the old password is wrong.

Source

Thrown at backend/open_webui/routers/auths.py:417

        if user:
            try:
                validate_password(form_data.new_password)
            except Exception as e:
                raise HTTPException(400, detail=str(e))
            hashed = await get_password_hash(form_data.new_password)
            success = await Auths.update_user_password_by_id(user.id, hashed, db=db)
            if success:
                await publish_event(
                    request,
                    EVENTS.AUTH_PASSWORD_CHANGED,
                    actor=user,
                    subject_id=user.id,
                    subject_type='user',
                )
            return success
        else:
            raise HTTPException(400, detail=ERROR_MESSAGES.INCORRECT_PASSWORD)
    else:
        raise HTTPException(400, detail=ERROR_MESSAGES.INVALID_CRED)


def _unescape_ldap_dn_value(value: str) -> str:
    """Resolve RFC 4514 escapes in a DN value, e.g. ``CN=Sales\\, EMEA`` -> ``Sales, EMEA``.

    Consecutive ``\\XX`` hex escapes encode UTF-8 bytes and are decoded together.
    """
    hexdigits = '0123456789abcdefABCDEF'
    result = []
    pos = 0
    length = len(value)
    while pos < length:
        char = value[pos]
        if char == '\\' and pos + 1 < length:
            if pos + 2 < length and value[pos + 1] in hexdigits and value[pos + 2] in hexdigits:
                byte_values = bytearray()

View on GitHub (pinned to 01f4282f1f)

Solutions

Re-enter the CURRENT password (not the new one) in the old-password field and retry.
If forgotten, request an admin reset, then change it again with the temporary value as the old password.
Update the password manager entry to the current password before retrying.
Verify no whitespace/case-transform is being applied by the client.

Defensive patterns

Strategy: validation

Validate before calling

# Verify the current password before calling the endpoint
from passlib.context import CryptContext
pwd_ctx = CryptContext(schemes=['bcrypt'], deprecated='auto')

def current_password_correct(supplied: str, stored_hash: str) -> bool:
    return pwd_ctx.verify(supplied, stored_hash)  # only possible when you hold the hash

Try / catch

from fastapi import HTTPException
try:
    await client.post('/api/v1/auths/update/password', json=payload)
except HTTPException as e:
    if e.status_code == 400 and 'password provided is incorrect' in str(e.detail):
        # old password mismatch: re-prompt for CURRENT password; do not resend
        focus_old_password_field()
    raise

Prevention

Distinguish 'Current password' and 'New password' fields visually and in autofill attributes.
After any successful password change, immediately update the password manager entry.
Offer an admin-reset escape hatch in the UI instead of repeated guessing (which may trip lockouts).

When it happens

Trigger: POST /update/password where form_data.password is not the account's current password: typo, password already changed on another device, admin-reset password the user hasn't seen, or autofill of an old credential.

Common situations: Password managers injecting stale entries; concurrent sessions after a reset; users confusing the old and new password fields.

Related errors

AI-assisted analysis of open-webui/open-webui@01f4282f1f (2026-08-14). Data as JSON: /api/errors/a59b7862f3c4926a. Report an issue: GitHub.