[Bug]: Errors when changing login password in a server with SSE user encryption

[pacoandres]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I'm using SSE user encryption. When the user changes the login password and re-signs in is prompted to update the encryption key password. But is not possible and an error is logged.
Then the user can't upload any file, throwing an exception in the logs, but can access to the previously uploaded files.

Steps to reproduce

1. Activate SSE with user keys.
2. Create an user, sign in and upload some files.
3. Change the password and re-sign in.
4. Open uploaded files, every file is readable.
5. Try to change the encryption key password as prompted, nothing happens in the front end, but there's an error in the log.

Expected behavior

When the user is prompted to change the encryption private key password and goes to change it, it must be changed without error.

Nextcloud Server version

34

Operating system

Other

PHP engine version

PHP 8.5

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "almacen.itsmoroto.info"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "34.0.1.2",
        "overwrite.cli.url": "https:\/\/almacen.itsmoroto.info",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "config_preset": 2,
        "mail_smtpmode": "sendmail",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mail_smtptimeout": 10,
        "mail_smtpsecure": "",
        "mail_smtpauth": false,
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "twofactor_enforced": "false",
        "twofactor_enforced_groups": [],
        "twofactor_enforced_excluded_groups": [],
        "defaultapp": "files",
        "maintenance": false,
        "maintenance_window_start": 1,
        "localstorage.allowsymlinks": true,
        "skeletondirectory": "",
        "default_language": "es",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "timeout": 0
        },
        "app_install_overwrite": [],
        "theme": "",
        "loglevel": 2,
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "logfile_audit": "\/var\/log\/nextcloud\/audit.log",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "updatedirectory": "\/home\/http\/nc_backups"
    }
}

List of activated Apps

Enabled:
  - activity: 7.0.0
  - announcementcenter: 7.4.1
  - appstore: 1.0.0
  - bruteforcesettings: 7.0.0
  - calendar: 6.5.0
  - circles: 34.0.0
  - cloud_federation_api: 1.18.0
  - contacts: 8.7.3
  - contactsinteraction: 1.15.0
  - dav: 1.39.0
  - encryption: 2.22.0
  - end_to_end_encryption: 2.2.0
  - federatedfilesharing: 1.24.0
  - files: 2.6.0
  - files_downloadlimit: 5.2.0-dev.0
  - files_lock: 34.0.0
  - files_pdfviewer: 7.0.0-dev.0
  - files_reminders: 1.7.0
  - files_sharing: 1.26.0
  - files_trashbin: 1.24.0
  - files_versions: 1.27.0
  - guests: 4.8.0
  - logreader: 7.0.0
  - lookup_server_connector: 1.22.0
  - nextcloud_announcements: 6.0.0
  - notifications: 7.0.0-dev.1
  - oauth2: 1.22.0
  - office: 1.0.0
  - password_policy: 6.0.0-dev.0
  - photos: 7.0.0
  - privacy: 6.0.0-dev.1
  - profile: 1.3.0
  - provisioning_api: 1.24.0
  - recommendations: 7.0.0
  - related_resources: 5.0.0-dev.0
  - serverinfo: 6.0.0
  - settings: 1.17.0
  - sharebymail: 1.24.0
  - support: 6.0.0
  - survey_client: 6.0.0-dev.0
  - text: 8.0.0
  - theming: 2.9.0
  - twofactor_backupcodes: 1.23.0
  - twofactor_totp: 16.0.0
  - updatenotification: 1.24.0
  - user_status: 1.14.0
  - viewer: 7.0.0-dev.0
  - weather_status: 1.14.0
  - webhook_listeners: 1.6.0
  - workflowengine: 2.16.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"GQVM5f4GTfeJKJ44qxNk","level":2,"time":"2026-07-09T17:58:29+00:00","remoteAddr":"213.94.48.130","user":"pacotest","app":"core","method":"POST","url":"/index.php/apps/encryption/ajax/updatePrivateKeyPassword","scriptName":"/index.php","message":"Login failed: 'pacotest' (Remote IP: '213.94.48.130')","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0","version":"34.0.1.2","data":{"app":"core"}}
{"reqId":"GQVM5f4GTfeJKJ44qxNk","level":2,"time":"2026-07-09T17:58:29+00:00","remoteAddr":"213.94.48.130","user":"pacotest","app":"core","method":"POST","url":"/index.php/apps/encryption/ajax/updatePrivateKeyPassword","scriptName":"/index.php","message":"Login failed: 'pacotest' (Remote IP: '213.94.48.130')","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0","version":"34.0.1.2","data":{"app":"core"}}

Additional info

OS: Arch Linux

[pacoandres]

I've take a look to find why this happens, and the problem is that the method updatePrivateKeyPassword of class OCA\Encryption\Controller\SettingsController obtains false when calling to checkPassword method of IUserManager.
This happens twice (that's the reason for the error being logged twice) in lines 68 and 74.

By now I haven't find the implementation of checkPassword method as it seems to be a virtual method in the interface and it's hard to me to find where is.

The problem is that the variable $newPassword is an empty string.

[pacoandres]

I've debugged the generated javascript code for private key password changing, and the objects that are supposed to contain the old and new passwords contains empty strings.
I've hardcoded the old and new password editing the javascript code in Chrome and everything work ok.

I think there's something wrong in the Encryption module that leads to this faulty javascript, but I don't know where to search. Anyone can help?

Thanks.