Invalid password
A sensitive account action asked for your account password and the check failed. Used by disable 2FA, reveal API key, reveal reseller API credentials, and similar routes — not the login form’s Invalid email or password.
Why this happens
verifyPassword against passwordHash returned false. Typo, caps lock, or wrong account. Distinct from Current password is incorrect (change-password on profile) and from Incorrect file password (file gate).
Diagnose and fix
1. Re-enter the account password carefully; retry.
2. If forgotten, use Login and password reset, then retry the action.
3. Social-only accounts may need to set a password first before reveal/disable flows.
4. Staff should not confuse this with file-access passwords.