Page MenuHomePhabricator

Password reset broken on Android App
Closed, ResolvedPublic1 Estimated Story PointsBUG REPORT

Description

I just watched a friend trying and failing to reset their password via the Android App. I also reproduced this on my own Android App.

Steps to replicate the issue (include links if applicable):

  • On the app, go to the login screen
  • tap "Forgot your password"
  • browser opens, but nothing happens, no page is loading just a white page
  • reload the page which makes it actually load the form
  • enter the required information
  • get the email with the temp password
  • go back to the app
  • go to the log in screen
  • enter user name and temp password
  • required to enter email verification code
  • go to the email you got and copy the code and enter it in the form on the app
  • see the form to enter a new password and confirm it
  • go to your password manager and copy a newly generated password
  • paste into both fields and click the submit button

What happens?:
Error message: "Incorrect username or password entered. Please try again."

What should have happened instead?:
My password should have been changed, and I should be logged in.

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):
Freshly installed Android App on a Pixel 8 Pro

Event Timeline

Michael renamed this task from Password reset broken to Password reset broken on Android App.Feb 18 2026, 11:55 AM
Dreamy_Jazz subscribed.

Don't think password resets / the android app are within the scope of Product Safety and Integrity

Don't think password resets / the android app are within the scope of Product Safety and Integrity

My thinking is that I have not confirmed whether that is an issue _only_ on the apps. Also, while I noticed it on the App, the error message "Incorrect username or password entered. Please try again." makes it suspiciously sound like a logic-issue in our password reset code.

Do we have a dashboard somewhere about the number of attempted and successful password resets?

Don't think password resets / the android app are within the scope of Product Safety and Integrity

My thinking is that I have not confirmed whether that is an issue _only_ on the apps. Also, while I noticed it on the App, the error message "Incorrect username or password entered. Please try again." makes it suspiciously sound like a logic-issue in our password reset code.

Do we have a dashboard somewhere about the number of attempted and successful password resets?

Not that I am aware of. MediaWiki-Platform-Team appear to own authorisation and authentication, so maybe password resets are in their scope and so they may know?

Dbrant triaged this task as High priority.

(No way to filter for password resets in the Android app, unfortunately. gerrit 1240375 will fix that.)

As far as I can tell from the fix, this was introduced in June last year, and it has been broken since. Logstash does not go back that far. But we might see the impact of the fix 🤞

ABorbaWMF subscribed.

Appears to be fixed on 50568-r-2026-02-24, tested on OnePlus 8 on Android 13, and Pixel 6 on Android 16. Tested on 2 different accounts.