[Issue]: Password resets without entering old password #4611

New Issue

OVERLORD · 2026-02-07T01:00:11+03:00

OVERLORD commented

2026-02-07 01:00:11 +03:00

Originally created by @matjako on GitHub (Feb 8, 2023).

Please describe your bug

When using WEB based clients I edit any user profile, if I leave "current password" and "new password" fields empty and press "save" above "reset password", the empty password is saved and the user has empty password set.
If I am logged in as admin and change other user profile, and both password fields are empty, pressing "save" also sets new empty password.

It appears no check is made if current password is correct.

If possible change behavior to not allow empty passwords and also change "save" to "save password". It is really easy to not scroll down the page and just click the first save button that you see.

Jellyfin Version

10.8.0

if other:

10.8.9

Environment

- OS: Windows
- Virtualization: none
- Clients: web
- Browser: mozilla
- FFmpeg Version: n/a
- Playback Method: n/a
- Hardware Acceleration: n/a
- Plugins: n/a
- Reverse Proxy: Nginx Proxy Manager
- Base URL: n/a
- Networking: n/a
- Storage: n/a

Jellyfin logs

No response

FFmpeg logs

No response

Please attach any browser or client logs here

No response

Please attach any screenshots here

No response

Code of Conduct

I agree to follow this project's Code of Conduct

Originally created by @matjako on GitHub (Feb 8, 2023). ### Please describe your bug When using WEB based clients I edit any user profile, if I leave "current password" and "new password" fields empty and press "save" above "reset password", the empty password is saved and the user has empty password set. If I am logged in as admin and change other user profile, and both password fields are empty, pressing "save" also sets new empty password. It appears no check is made if current password is correct. If possible change behavior to not allow empty passwords and also change "save" to "save password". It is really easy to not scroll down the page and just click the first save button that you see. ### Jellyfin Version 10.8.0 ### if other: 10.8.9 ### Environment ```markdown - OS: Windows - Virtualization: none - Clients: web - Browser: mozilla - FFmpeg Version: n/a - Playback Method: n/a - Hardware Acceleration: n/a - Plugins: n/a - Reverse Proxy: Nginx Proxy Manager - Base URL: n/a - Networking: n/a - Storage: n/a ``` ### Jellyfin logs _No response_ ### FFmpeg logs _No response_ ### Please attach any browser or client logs here _No response_ ### Please attach any screenshots here _No response_ ### Code of Conduct - [X] I agree to follow this project's Code of Conduct

OVERLORD added the bug label 2026-02-07 01:00:11 +03:00

OVERLORD closed this issue

2026-02-07 01:00:12 +03:00

OVERLORD commented

2026-02-07 01:00:15 +03:00

@cvium commented on GitHub (Feb 8, 2023):

also change "save" to "save password"

This is web-specific and not server related.

Duplicate of #9208

@cvium commented on GitHub (Feb 8, 2023): > also change "save" to "save password" This is web-specific and not server related. Duplicate of #9208

OVERLORD referenced this issue

2026-02-07 06:15:39 +03:00

[PR #4611] [CLOSED] Enable Nullable for Jellyfin #10187

Sign in to join this conversation.

Branches Tags

master

renovate/major-skiasharp-monorepo

renovate/sharpcompress-0.x

renovate/svg.skia-5.x

renovate/ghcr.io-devcontainers-features-docker-in-docker-4.x

release-10.11.z

standards-fix

release-10.9.z

openapi-cache

release-10.10.z

explicit-load

explicit-load-v2

feature/entity-framework

only-count-folder-item

fix/ci-workflow-refactor

release-10.8.z

release-10.7.z

EraYaN-add-management-interface

release-10.6.z

release-10.5.z

release-10.4.z

release-10.3.z

release-10.2.z

release-10.1.0

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/jellyfin#4611