Repository navigation
[Bug]: account delete does not verify password #3297
Description
What did you expect to happen?
I expect error when password wrong.
What happened?
Account is deleted when entering wrong password.
reproduce steps:
- use self-hosted server
atuin registertest user with passwordnicepasswordatuin account delete(enter password:wrongpassword)
Then account is gone. Get message: Your account is deleted
I checked database and account really not there anymore.
Atuin doctor output
{
"atuin": {
"version": "18.13.3",
"commit": "e737ba5b9a149eaec706418bc560e8ba7ea8c81b",
"sync": null,
"sqlite_version": "3.46.0"
},
"shell": {
"name": "bash",
"default": "bash",
"plugins": [
"atuin",
"blesh"
],
"preexec": "blesh-0.4.0-devel4+b99cadb"
},
"system": {
"os": "Fedora Linux",
"arch": "x86_64",
"version": "43",
"disks": [
{
"name": "/dev/mapper/rootvg-root",
"filesystem": "xfs"
},
{
"name": "/dev/sda1",
"filesystem": "xfs"
},
{
"name": "/dev/sdb1",
"filesystem": "xfs"
}
]
}
}Code of Conduct
- I agree to follow this project's Code of Conduct
Activity
jaimep12 commentedon Mar 30, 2026
markovejnovic commentedon Jul 15, 2026
Hey, I'll pick this up. The main reason we didn't implement this before is because, if the user loses their password, they have pretty much no way of deleting their account.
The reasoning is that:
a) The current set-up is mostly safe, since someone can't really log in without the session token.
b) If you lose your password, you kind of have no mechanism to delete your account.
I am working on adding a new "admin " set of CLI tools to the server which will enable the person who manages the self-hosted server to delete pretty anyone, and we'll implement your request afterwards.
Thanks for opening the issue!
jaimep12 commentedon Sep 23, 2026
Thank you for looking into this. Not sure why, but I did not get a notification mail. github sometimes buggy.
You are correct. You have to know the password to login so that you can delete account. But I was a bit confused that I was asked for password and then after entering the wrong one, my account was still deleted. So something in flow not correct.
If not checking correctness of password this prompt can be changed to "Do you want to REALLY delete your account?" and only if answer is
yesorythe account is deleted. Currently the account is deleted when answering anything, so prompt makes no sense.jaimep12 commentedon Oct 19, 2026
Did you see my last reply? Sorry, but it was a month ago.
markovejnovic commentedon Oct 24, 2026
Just saw. That looks suspicious. I am guessing that the account didn't actually get deleted. I'll get a reproduction and a fix.
jaimep12 commentedon Oct 26, 2026
I checked and the account was deleted. It is no longer in database.
markovejnovic commentedon Oct 26, 2026
Got it, thanks for checking!
markovejnovic commentedon Oct 28, 2026
doh you even mentioned it, sorry, i missed it. I'm aiming to implement this for the next release, since it seems like a security concern. investigating right now
fix(server): check the password before deleting an account (#4572)
jaimep12 commentedon Oct 28, 2026
I will test this when the new version is available. Thank you.
jaimep12 commentedon Oct 29, 2026
It did not work when I only used the new client. Then I updated the server and it worked. Thank you.
But I also see another error:
Error: could not ask the daemon for its status: code: 'The system is not in a state required for the operation's execution', message: "daemon is build 18.24.2+854654ec1ec6d13e0eb2468a6e57b2e2044a2162, client is build 18.24.3+4532ceacd860885c2310ab8fab92a1bc00d6d7e8"I cannot even stop the daemon, but needed to kill it with
kill PID. This seems strange to me that I cannot restart/stop the daemon or that atuin does the restart automatically. Other daemon operations make sense to not able to run, but stop/restart?