I have searched for any existing and/or related issues.
I have searched for any existing and/or related discussions.
I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
I am using the latest version of Open WebUI.
Installation Method
Docker
Open WebUI Version
0.8.10
Ollama Version (if applicable)
0.17.7
Operating System
openSUSE Tumbleweed
Browser (if applicable)
Brave v1.88.134
Confirmation
I have read and followed all instructions in README.md.
I am using the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided every relevant configuration, setting, and environment variable used in my setup.
I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
Start with the initial platform/version/OS and dependencies used,
Specify exact install/launch/configure commands,
List URLs visited, user input (incl. example values/emails/passwords if needed),
Describe all options and toggles enabled or changed,
Include any files or environmental changes,
Identify the expected and actual result at each stage,
Ensure any reasonably skilled user can follow and hit the same issue.
Expected Behavior
The new password should be validated against the configured `PASSWORD_VALIDATION_REGEX_PATTERN environment variable and rejected if it does not meet the complexity requirements.
Actual Behavior
validate_password() is called with form_data.password (the current/old password) instead of form_data.new_password. Since the old password already met the rule when it was set, the check always passes.
Steps to Reproduce
Configure a password complexity rule via environment variable VALIDATE_PASSWORD_REGEX_PATTERN
Sign in with a valid account
Change your password to one that does not meet the complexity rule
The change succeeds without error
Logs & Screenshots
Environment variables regarding password validation i have set
PASSWORD_VALIDATION_REGEX_PATTERN=^.{15,}$
ENABLE_PASSWORD_VALIDATION=true
In UpdatePasswordForm, there are two fields — password (current) and new_password (new). The validate_password call incorrectly references the former.
For comparison, the signup and add_user handlers use a single-field form where form_data.password correctly refers to the new password being set — so those endpoints are unaffected.
Originally created by @Mogelmose on GitHub (Mar 23, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/22958
### Check Existing Issues
- [x] I have searched for any existing and/or related issues.
- [x] I have searched for any existing and/or related discussions.
- [x] I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
- [x] I am using the latest version of Open WebUI.
### Installation Method
Docker
### Open WebUI Version
0.8.10
### Ollama Version (if applicable)
0.17.7
### Operating System
openSUSE Tumbleweed
### Browser (if applicable)
Brave v1.88.134
### Confirmation
- [x] I have read and followed all instructions in `README.md`.
- [x] I am using the latest version of **both** Open WebUI and Ollama.
- [x] I have included the browser console logs.
- [x] I have included the Docker container logs.
- [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.**
- [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
- [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps:
- Start with the initial platform/version/OS and dependencies used,
- Specify exact install/launch/configure commands,
- List URLs visited, user input (incl. example values/emails/passwords if needed),
- Describe all options and toggles enabled or changed,
- Include any files or environmental changes,
- Identify the expected and actual result at each stage,
- Ensure any reasonably skilled user can follow and hit the same issue.
### Expected Behavior
The new password should be validated against the configured `PASSWORD_VALIDATION_REGEX_PATTERN environment variable and rejected if it does not meet the complexity requirements.
### Actual Behavior
`validate_password()` is called with `form_data.password` (the current/old password) instead of `form_data.new_password`. Since the old password already met the rule when it was set, the check always passes.
### Steps to Reproduce
1. Configure a password complexity rule via environment variable VALIDATE_PASSWORD_REGEX_PATTERN
2. Sign in with a valid account
3. Change your password to one that does not meet the complexity rule
4. The change succeeds without error
### Logs & Screenshots
Environment variables regarding password validation i have set
PASSWORD_VALIDATION_REGEX_PATTERN=^.{15,}$
ENABLE_PASSWORD_VALIDATION=true
### Additional Information
**Location**
`backend/open_webui/routers/auths.py` — `update_password` handler
In `UpdatePasswordForm`, there are two fields — `password` (current) and `new_password` (new). The `validate_password` call incorrectly references the former.
For comparison, the `signup` and `add_user` handlers use a single-field form where `form_data.password` correctly refers to the new password being set — so those endpoints are unaffected.
GiteaMirror
added the bug label 2026-05-13 07:10:59 -05:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @Mogelmose on GitHub (Mar 23, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/22958
Check Existing Issues
Installation Method
Docker
Open WebUI Version
0.8.10
Ollama Version (if applicable)
0.17.7
Operating System
openSUSE Tumbleweed
Browser (if applicable)
Brave v1.88.134
Confirmation
README.md.Expected Behavior
The new password should be validated against the configured `PASSWORD_VALIDATION_REGEX_PATTERN environment variable and rejected if it does not meet the complexity requirements.
Actual Behavior
validate_password()is called withform_data.password(the current/old password) instead ofform_data.new_password. Since the old password already met the rule when it was set, the check always passes.Steps to Reproduce
Logs & Screenshots
Environment variables regarding password validation i have set
PASSWORD_VALIDATION_REGEX_PATTERN=^.{15,}$
ENABLE_PASSWORD_VALIDATION=true
Additional Information
Location
backend/open_webui/routers/auths.py—update_passwordhandlerIn
UpdatePasswordForm, there are two fields —password(current) andnew_password(new). Thevalidate_passwordcall incorrectly references the former.For comparison, the
signupandadd_userhandlers use a single-field form whereform_data.passwordcorrectly refers to the new password being set — so those endpoints are unaffected.@tjbck commented on GitHub (Mar 24, 2026):
Addressed in dev.