unslothai/unsloth · warning · HTTPException

New password must be different from the current password

Error message

New password must be different from the current password

What it means

/change-password refuses no-op changes: if new_password equals current_password it returns HTTP 400 'New password must be different from the current password'. Note the comparison is exact string equality against the submitted current_password, which has already been verified against the stored hash by this point.

Source

Thrown at studio/backend/routes/auth.py:633

    if record is None:
        raise HTTPException(
            status_code = status.HTTP_401_UNAUTHORIZED,
            detail = "User session is invalid",
        )

    salt, pwd_hash, _jwt_secret, _must_change_password = record
    if not hashing.verify_password(payload.current_password, salt, pwd_hash):
        raise HTTPException(
            status_code = status.HTTP_401_UNAUTHORIZED,
            detail = "Current password is incorrect",
        )
    if any(ch.isspace() for ch in payload.new_password):
        raise HTTPException(
            status_code = status.HTTP_400_BAD_REQUEST,
            detail = "New password cannot contain spaces",
        )
    if payload.current_password == payload.new_password:
        raise HTTPException(
            status_code = status.HTTP_400_BAD_REQUEST,
            detail = "New password must be different from the current password",
        )

    # Single transaction: a separate refresh-token purge could fail after the
    # password commit, leaving pre-change tokens able to mint access tokens.
    # Conditional on the hash just verified: a reset-password that landed while
    # this request was in flight must not be overwritten by it.
    # The desktop app authenticates with a local secret rather than this
    # password; revoking that secret would break its auto-auth over a change it
    # made itself. A browser session still revokes it.
    new_secret = storage.update_password(
        current_subject,
        payload.new_password,
        revoke_refresh_tokens = True,
        expect_password_hash = pwd_hash,
        preserve_desktop_secret = is_desktop,
    )

View on GitHub (pinned to 203007d190)

Solutions

1. Choose a genuinely different new password
2. Disable the submit button client-side until new != current
3. In rotation scripts, assert new_password != current_password before calling

Example fix

# before
body = {"current_password": pw, "new_password": pw}
# after
assert new_pw != pw
body = {"current_password": pw, "new_password": new_pw}

def distinct_new_password(cur: str, new: str) -> bool:
    return new != cur

When it happens

Trigger: Submitting identical current and new password values, including via a UI bug that pre-fills the new-password field with the current one.

Common situations: Forms that copy the current password into the new field; 'change' clicks that submit unchanged values; automated rotation scripts falling back to the old value.

Related errors

• New password cannot contain spaces
• nonce must be base64url
• nonce must decode to 16-128 bytes
• Request failed (${status})
• family {getattr(fam, 'name', fam)!r} declares no prequant_fi

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/e8a0518102bbec0e. Report an issue: GitHub.