[Bug]: Password confirmation is required message when using the user provisioning api

[RHSvof]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

We use a script to automatically create users in Nextcloud via the user provisioning API; this script has not been working since the update to version 34.

Calling the relevant API returns the following message:

failure 403 Password confirmation is required

The user in question has admin rights, is protected by 2FA, and we use an app password to authenticate API calls.
This worked perfectly for several hundred users right up to Nextcloud version 34.

For the test, 2FA was disabled for the user and the normal user password was used instead of the app password.
This also resulted in the message mentioned above.
Using the V2 API did not improve the situation either.

Steps to reproduce

1.$ curl -X POST http://admin:secret@example.com/ocs/v1.php/cloud/users -d userid="Frank" -d password="frankspassword" -H "OCS-APIRequest: true"
2.
3.

Expected behavior

Logging in using the APP password is now working again, and users can once more be created correctly via script.

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "mydomain.local",
        ],
        "trusted_network": "xxx.xxx.xxx.xxx\/16",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "34.0.1.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "ldapIgnoreNamingRules": false,
        "theme": "",
        "upgrade.disable-web": true,
        "maintenance": false,
        "maintenance_window_start": 1,
        "appstore.experimental.enabled": true,
        "mail_smtpmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "trashbin_retention_obligation": "auto, 14",
        "updater.release.channel": "stable",
        "overwrite.cli.url": "https:\/\/mydomain.de",
        "app_install_overwrite": [
            "groupfolders",
            "spreed",
            "impersonate"
        ],
        "mail_sendmailmode": "smtp",
        "mysql.utf8mb4": true,
        "default_language": "de",
        "default_locale": "de_DE",
        "default_phone_region": "DE",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": "true",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0,
            "dbindex": 0
        },
        "mail_smtpport": "25",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": false,
                "verify_peer": true,
                "verify_peer_name": false
            }
        },
        "loglevel": 3,
        "dav.public.chunking": "true",
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "admin"
        ],
        "twofactor_enforced_excluded_groups": []
    }
}

List of activated Apps

Enabled:
  - activity: 7.0.0
  - admin_audit: 1.24.0
  - announcementcenter: 7.4.1
  - app_api: 34.0.0
  - appointments: 2.7.4
  - appstore: 1.0.0
  - bruteforcesettings: 7.0.0
  - calendar: 6.5.0
  - circles: 34.0.0
  - cloud_federation_api: 1.18.0
  - comments: 1.24.0
  - contacts: 8.7.3
  - contactsinteraction: 1.15.0
  - cookbook: 0.11.8
  - dashboard: 7.14.0
  - dav: 1.39.0
  - deck: 1.18.2
  - eidlogin: 1.0.22
  - event_update_notification: 2.9.0
  - federatedfilesharing: 1.24.0
  - federation: 1.24.0
  - files: 2.6.0
  - files_accesscontrol: 5.0.0
  - files_automatedtagging: 5.0.0
  - files_downloadlimit: 5.2.0-dev.0
  - files_external: 1.26.0
  - files_lock: 34.0.0
  - files_pdfviewer: 7.0.0-dev.0
  - files_reminders: 1.7.0
  - files_sharing: 1.26.0
  - files_trashbin: 1.24.0
  - files_versions: 1.27.0
  - firstrunwizard: 7.0.0-dev.0
  - flow_notifications: 5.0.0
  - forms: 5.3.2
  - groupfolders: 22.0.2
  - impersonate: 5.0.0
  - logreader: 7.0.0
  - lookup_server_connector: 1.22.0
  - nextcloud_announcements: 6.0.0
  - notes: 6.0.1
  - notifications: 7.0.0-dev.1
  - oauth2: 1.22.0
  - office: 1.0.0
  - password_policy: 6.0.0-dev.0
  - photos: 7.0.0
  - polls: 9.1.4
  - profile: 1.3.0
  - provisioning_api: 1.24.0
  - related_resources: 5.0.0-dev.0
  - richdocuments: 11.0.0
  - serverinfo: 6.0.0
  - settings: 1.17.0
  - sharebymail: 1.24.0
  - spreed: 24.0.2
  - suspicious_login: 12.0.0-dev.0
  - systemtags: 1.24.0
  - tables: 2.2.0
  - tasks: 0.18.1
  - text: 8.0.0
  - theming: 2.9.0
  - twofactor_backupcodes: 1.23.0
  - twofactor_totp: 16.0.0
  - twofactor_webauthn: 2.7.0
  - updatenotification: 1.24.0
  - user_status: 1.14.0
  - viewer: 7.0.0-dev.0
  - weather_status: 1.14.0
  - webhook_listeners: 1.6.0
  - workflowengine: 2.16.0
Disabled:
  - encryption: 2.22.0 (installed 1.0.0)
  - files_antivirus: 6.3.0 (installed 6.3.0)
  - privacy: 6.0.0-dev.1 (installed 1.0.0)
  - quicknotes: 0.8.50 (installed 0.8.50)
  - recommendations: 7.0.0 (installed 0.4.0)
  - support: 6.0.0 (installed 1.0.0)
  - survey_client: 6.0.0-dev.0 (installed 1.10.0)
  - testing: 1.23.0
  - twofactor_nextcloud_notification: 8.0.0
  - user_ldap: 1.25.0 (installed 0.6.1)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"6Cge0UAlb9D0cCXrOjt5","level":0,"time":"2026-07-10T13:16:59+00:00","remoteAddr":"xxx.xxx.xxx.xxx","user":"username","app":"no app in context","method":"POST","url":"/ocs/v1.php/cloud/users","scriptName":"/ocs/v1.php","message":"dirty table reads: SELECT * FROM `*PREFIX*authtoken` WHERE (`token` = :dcValue1) AND (`version` = :dcValue2)","userAgent":"curl/8.18.0","version":"34.0.1.2","exception":{"Exception":"Exception","Message":"dirty table reads: SELECT * FROM `*PREFIX*authtoken` WHERE (`token` = :dcValue1) AND (`version` = :dcValue2)","Code":0,"Trace":[{"file":"/var/www/ofcloud.offenbach.de/lib/private/DB/ConnectionAdapter.php","line":57,"function":"executeQuery","class":"OC\\DB\\Connection","type":"->"},{"file":"/var/www/ofcloud.offenbach.de/lib/private/DB/QueryBuilder/QueryBuilder.php","line":261,"function":"executeQuery","class":"OC\\DB\\ConnectionAdapter","type":"->"},{"file":"/var/www/ofcloud.offenbach.de/lib/private/Authentication/Token/PublicKeyTokenMapper.php","line":76,"function":"executeQuery","class":"OC\\DB\\QueryBuilder\\QueryBuilder","type":"->"},{"file":"/var/www/ofcloud.offenbach.de/lib/private/Authentication/Token/PublicKeyTokenProvider.php","line":137,"function":"getToken","class":"OC\\Authentication\\Token\\PublicKeyTokenMapper","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/ofcloud.offenbach.de/lib/private/Authentication/Token/Manager.php","line":126,"function":"getToken","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/ofcloud.offenbach.de/lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php","line":69,"function":"getToken","class":"OC\\Authentication\\Token\\Manager","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/ofcloud.offenbach.de/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php","line":73,"function":"beforeController","class":"OC\\AppFramework\\Middleware\\Security\\PasswordConfirmationMiddleware","type":"->"},{"file":"/var/www/ofcloud.offenbach.de/lib/private/AppFramework/Http/Dispatcher.php","line":70,"function":"beforeController","class":"OC\\AppFramework\\Middleware\\MiddlewareDispatcher","type":"->"},{"file":"/var/www/ofcloud.offenbach.de/lib/private/AppFramework/App.php","line":137,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/ofcloud.offenbach.de/lib/private/Route/Router.php","line":324,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/ofcloud.offenbach.de/ocs/v1.php","line":63,"function":"match","class":"OC\\Route\\Router","type":"->"}],"File":"/var/www/ofcloud.offenbach.de/lib/private/DB/Connection.php","Line":407,"message":"dirty table reads: SELECT * FROM `*PREFIX*authtoken` WHERE (`token` = :dcValue1) AND (`version` = :dcValue2)","tables":"[\"oc_authtoken\",\"oc_preferences\",\"oc_login_address\"]","reads":"[\"oc_authtoken\"]","exception":"{\"class\":\"Exception\",\"message\":\"dirty table reads: SELECT * FROM `*PREFIX*authtoken` WHERE (`token` = :dcValue1) AND (`version` = :dcValue2)\",\"code\":0,\"file\":\"/var/www/ofcloud.offenbach.de/lib/private/DB/Connection.php:407\",\"trace\":\"#0 /var/www/ofcloud.offenbach.de/lib/private/DB/ConnectionAdapter.php(57): OC\\DB\\Connection->executeQuery()\\n#1 /var/www/ofcloud.offenbach.de/lib/private/DB/QueryBuilder/QueryBuilder.php(261): OC\\DB\\ConnectionAdapter->executeQuery()\\n#2 /var/www/ofcloud.offenbach.de/lib/private/Authentication/Token/PublicKeyTokenMapper.php(76): OC\\DB\\QueryBuilder\\QueryBuilder->executeQuery()\\n#3 /var/www/ofcloud.offenbach.de/lib/private/Authentication/Token/PublicKeyTokenProvider.php(137): OC\\Authentication\\Token\\PublicKeyTokenMapper->getToken()\\n#4 /var/www/ofcloud.offenbach.de/lib/private/Authentication/Token/Manager.php(126): OC\\Authentication\\Token\\PublicKeyTokenProvider->getToken()\\n#5 /var/www/ofcloud.offenbach.de/lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php(69): OC\\Authentication\\Token\\Manager->getToken()\\n#6 /var/www/ofcloud.offenbach.de/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php(73): OC\\AppFramework\\Middleware\\Security\\PasswordConfirmationMiddleware->beforeController()\\n#7 /var/www/ofcloud.offenbach.de/lib/private/AppFramework/Http/Dispatcher.php(70): OC\\AppFramework\\Middleware\\MiddlewareDispatcher->beforeController()\\n#8 /var/www/ofcloud.offenbach.de/lib/private/AppFramework/App.php(137): OC\\AppFramework\\Http\\Dispatcher->dispatch()\\n#9 /var/www/ofcloud.offenbach.de/lib/private/Route/Router.php(324): OC\\AppFramework\\App::main()\\n#10 /var/www/ofcloud.offenbach.de/ocs/v1.php(63): OC\\Route\\Router->match()\\n#11 {main}\"}","CustomMessage":"dirty table reads: SELECT * FROM `*PREFIX*authtoken` WHERE (`token` = :dcValue1) AND (`version` = :dcValue2)"},"id":"6a50f1c5017e6"}


{"reqId":"6Cge0UAlb9D0cCXrOjt5","level":0,"time":"2026-07-10T13:16:59+00:00","remoteAddr":"xxx.xxx.xxx.xxx","user":"username","app":"provisioning_api","method":"POST","url":"/ocs/v1.php/cloud/users","scriptName":"/ocs/v1.php","message":"Password confirmation is required","userAgent":"curl/8.18.0","version":"34.0.1.2","exception":{"Exception":"OC\\AppFramework\\Middleware\\Security\\Exceptions\\NotConfirmedException","Message":"Password confirmation is required","Code":403,"Trace":[{"file":"/var/www/ofcloud.offenbach.de/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php","line":73,"function":"beforeController","class":"OC\\AppFramework\\Middleware\\Security\\PasswordConfirmationMiddleware","type":"->"},{"file":"/var/www/ofcloud.offenbach.de/lib/private/AppFramework/Http/Dispatcher.php","line":70,"function":"beforeController","class":"OC\\AppFramework\\Middleware\\MiddlewareDispatcher","type":"->"},{"file":"/var/www/ofcloud.offenbach.de/lib/private/AppFramework/App.php","line":137,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/ofcloud.offenbach.de/lib/private/Route/Router.php","line":324,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/ofcloud.offenbach.de/ocs/v1.php","line":63,"function":"match","class":"OC\\Route\\Router","type":"->"}],"File":"/var/www/ofcloud.offenbach.de/lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php","Line":97,"message":"Password confirmation is required","exception":"{\"class\":\"OC\\AppFramework\\Middleware\\Security\\Exceptions\\NotConfirmedException\",\"message\":\"Password confirmation is required\",\"code\":403,\"file\":\"/var/www/ofcloud.offenbach.de/lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php:97\",\"trace\":\"#0 /var/www/ofcloud.offenbach.de/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php(73): OC\\AppFramework\\Middleware\\Security\\PasswordConfirmationMiddleware->beforeController()\\n#1 /var/www/ofcloud.offenbach.de/lib/private/AppFramework/Http/Dispatcher.php(70): OC\\AppFramework\\Middleware\\MiddlewareDispatcher->beforeController()\\n#2 /var/www/ofcloud.offenbach.de/lib/private/AppFramework/App.php(137): OC\\AppFramework\\Http\\Dispatcher->dispatch()\\n#3 /var/www/ofcloud.offenbach.de/lib/private/Route/Router.php(324): OC\\AppFramework\\App::main()\\n#4 /var/www/ofcloud.offenbach.de/ocs/v1.php(63): OC\\Route\\Router->match()\\n#5 {main}\"}","CustomMessage":"Password confirmation is required"},"id":"6a50f1c5017a8"}

Additional info

No response