Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

password_compromised

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The new password is a common one or appears in a breach corpus (400).

Meaning

A password being set is on the bundled list of common passwords (auth.password.refuse_common), or the breach lookup (auth.password.breach_lookup) found it in its corpus. Attackers try these first, so they are refused wherever a password is chosen (NIST SP 800-63B §3.1.1.2).

Impact

Nothing was changed; a reset or invitation link stays unspent. It is expected, and the user only needs another password. Signing in with a password already set is never affected.

Diagnosis

Look the request id up on the Troubleshooting page; the attempt is recorded with reason invalid_request and cause password_compromised. nauthera_auth_password_screens_total counts the outcomes common and breached apart.

Mitigation

  • As a user: choose a password you do not use anywhere else, such as a passphrase of several unrelated words.

Escalation

Escalate when a password generated at random is refused as breached: the breach lookup's url may point at an endpoint that does not answer as the range API does. Open an issue with the request id and the server version. Never attach the password.

Problem code runbooks · Generated from internal/runbook/problems.yaml in nauthera-server.