# password_compromised

The new password is a common one or appears in a breach corpus (400).

## Meaning

A password being set is on the bundled list of common passwords
(`auth.password.refuse_common`), or the breach lookup
(`auth.password.breach_lookup`) found it in its corpus. Attackers try these first,
so they are refused wherever a password is chosen (NIST SP 800-63B §3.1.1.2).

## Impact

Nothing was changed; a reset or invitation link stays unspent. It is expected, and
the user only needs another password. Signing in with a password already set is
never affected.

## Diagnosis

Look the request id up on the Troubleshooting page; the attempt is recorded with
reason `invalid_request` and cause `password_compromised`.
`nauthera_auth_password_screens_total` counts the outcomes `common` and
`breached` apart.

## Mitigation

- As a user: choose a password you do not use anywhere else, such as a passphrase
  of several unrelated words.

## Escalation

Escalate when a password generated at random is refused as breached: the breach
lookup's `url` may point at an endpoint that does not answer as the range API does.
Open an issue with the request id and the server version. Never attach the
password.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.