[Bug]: App password - authentication failed

[ktatar156]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I’m trying to create a new app password, but I’m getting this window:
obraz
obraz1118×444 40.6 KB

I am 100% sure that I’m entering the correct password, yet I keep getting an “incorrect password” error. 😦 Does anyone know why this is happening or how to fix it?

Thanks!

Steps to reproduce

as written above

Expected behavior

it should accept the password.

Nextcloud Server version

33

Operating system

None

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

[provokateurin]

Sounds similar to #53472

[susnux]

@ktatar156 can you open your browser dev tools and check the failing network request?
Can you please report:

• the return status (is it 401 or something different?)
• the response body of the failed request

[ktatar156]

XHRPOST https://192.168.0.103/nextcloud/index.php/settings/personal/authtokens [HTTP/1.1 403 Forbidden 44ms]
and

[WARN] @nextcloud/vue: You need to fill either the text or the ariaLabel props in the button component. 
Object { uid: "PRIVATELOGIN", app: "@nextcloud/vue", level: 2, text: undefined, ariaLabel: null, instance: {…} }
core-common.js:1:2920673
[WARN] @nextcloud/vue: You need to fill either the text or the ariaLabel props in the button component. 
Object { uid: "PRIVATELOGIN", app: "@nextcloud/vue", level: 2, text: undefined, ariaLabel: null, instance: {…} }
core-common.js:1:2920673
Notifications permissions denied NotificationsApp-zv-lMaEW.chunk.mjs:83:58316
Polling interval updated to 30000 NotificationsApp-zv-lMaEW.chunk.mjs:83:57611
Started background fetcher as session_keepalive is enabled NotificationsApp-zv-lMaEW.chunk.mjs:83:54771
Got notification data, restoring default polling interval. NotificationsApp-zv-lMaEW.chunk.mjs:83:56566
Błąd mapy źródła: No sources are declared in this source map.
URL zasobu: https://192.168.0.103/nextcloud/apps/firstrunwizard/js/modulepreload-polyfill-CBWYtosv.chunk.mjs
URL mapy źródła: modulepreload-polyfill-CBWYtosv.chunk.mjs.map
Błąd mapy źródła: No sources are declared in this source map.
URL zasobu: https://192.168.0.103/nextcloud/apps/notifications/js/vite-preload-helper-DxYC2qmj.chunk.mjs
URL mapy źródła: vite-preload-helper-DxYC2qmj.chunk.mjs.map
XHRPOST
https://192.168.0.103/nextcloud/index.php/settings/personal/authtokens
[HTTP/1.1 403 Forbidden 44ms]

[ERROR] @nextcloud/password-confirmation: Exception during password confirmation 
Object { app: "@nextcloud/password-confirmation", level: 2, error: AxiosError }
core-common.js:1:2920739

[stanleyowen]

Yeah I face the same issue too, recently trying to generate an external app password however I receive the warning of "Incorrect Password", I am sure that the password is correct. Tried changing password, turning on-off 2FA, and changing trusted_proxies wont work for the issue above.

Summary
URL: http://[***REDACTED***]/index.php/settings/personal/authtokens
Status: 403
Source: Network
Address: [***REDACTED***]
Initiator: 
xhr.js:198

Request
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9
Authorization: Basic [***REDACTED***]
Content-Length: [***REDACTED***]
Content-Type: application/json
Cookie: [***REDACTED***]
Origin: [***REDACTED***]
Priority: u=3, i
requesttoken: [***REDACTED***]
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Safari/605.1.15
X-Requested-With: XMLHttpRequest, XMLHttpRequest

Response
Alt-Svc: h3=":443"; ma=86400
Cache-Control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: [***REDACTED***]
Content-Encoding: zstd
Content-Security-Policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'
Content-Type: application/json; charset=utf-8
Date: Thu, 26 Mar 2026 04:02:08 GMT
feature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Priority: u=3,i
Referrer-Policy: no-referrer
Report-To: [***REDACTED***]
Server: cloudflare
Server-Timing: cfExtPri
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-powered-by: PHP/8.4.19
x-request-id: [***REDACTED***]
x-robots-tag: noindex, nofollow
x-user-id: [***REDACTED***]

Request Data
MIME Type: application/json
Request Data: 
{"name":"test","oneTime":true}


Preview:
{
    "message": "Required authorization header missing"
}