Wikimedia\NormalizedException\NormalizedException: Attempted to set global password for {user} but the expected CAS token doesn't match. Possible race condition!
Open, Needs TriagePublicPRODUCTION ERROR
Actions

Assigned To

None

Authored By

	Reedy
	Jan 7 2026, 10:50 PM

Project Tags

Referenced Files

None

Subscribers

Aklapper

Reedy

Tgr

Description

Error

service.version: 1.46.0-wmf.10
timestamp: 2026-01-07T22:48:04.410Z
labels.phpversion: 8.3.29
trace.id: 317ed309-50b5-4c1a-ab29-ce3ed0eceb34
Find trace.id in Logstash

labels.normalized_message

[{reqId}] {exception_url}   Wikimedia\NormalizedException\NormalizedException: Attempted to set global password for {user} but the expected CAS token doesn't match. Possible race condition!

Frame	Location	Call
from	/srv/mediawiki/php-1.46.0-wmf.10/extensions/CentralAuth/includes/User/CentralAuthUser.php(3184)
#0	/srv/mediawiki/php-1.46.0-wmf.10/extensions/CentralAuth/includes/User/CentralAuthUser.php(2602)	MediaWiki\Extension\CentralAuth\User\CentralAuthUser->setPassword(string, bool)
#1	/srv/mediawiki/php-1.46.0-wmf.10/includes/Deferred/MWCallableUpdate.php(52)	MediaWiki\Extension\CentralAuth\User\CentralAuthUser->MediaWiki\Extension\CentralAuth\User\{closure}(string)
#2	/srv/mediawiki/php-1.46.0-wmf.10/includes/Deferred/DeferredUpdates.php(444)	MediaWiki\Deferred\MWCallableUpdate->doUpdate()
#3	/srv/mediawiki/php-1.46.0-wmf.10/includes/Deferred/DeferredUpdates.php(187)	MediaWiki\Deferred\DeferredUpdates::attemptUpdate(MediaWiki\Deferred\MWCallableUpdate)
#4	/srv/mediawiki/php-1.46.0-wmf.10/includes/Deferred/DeferredUpdates.php(274)	MediaWiki\Deferred\DeferredUpdates::run(MediaWiki\Deferred\MWCallableUpdate)
#5	/srv/mediawiki/php-1.46.0-wmf.10/includes/Deferred/DeferredUpdatesScope.php(229)	MediaWiki\Deferred\DeferredUpdates::MediaWiki\Deferred\{closure}(MediaWiki\Deferred\MWCallableUpdate, int)
#6	/srv/mediawiki/php-1.46.0-wmf.10/includes/Deferred/DeferredUpdatesScope.php(158)	MediaWiki\Deferred\DeferredUpdatesScope->processStageQueue(int, int, Closure)
#7	/srv/mediawiki/php-1.46.0-wmf.10/includes/Deferred/DeferredUpdates.php(268)	MediaWiki\Deferred\DeferredUpdatesScope->processUpdates(int, Closure)
#8	/srv/mediawiki/php-1.46.0-wmf.10/includes/MediaWikiEntryPoint.php(653)	MediaWiki\Deferred\DeferredUpdates::doUpdates()
#9	/srv/mediawiki/php-1.46.0-wmf.10/includes/MediaWikiEntryPoint.php(475)	MediaWiki\MediaWikiEntryPoint->restInPeace()
#10	/srv/mediawiki/php-1.46.0-wmf.10/includes/MediaWikiEntryPoint.php(433)	MediaWiki\MediaWikiEntryPoint->doPostOutputShutdown()
#11	/srv/mediawiki/php-1.46.0-wmf.10/includes/MediaWikiEntryPoint.php(190)	MediaWiki\MediaWikiEntryPoint->postOutputShutdown()
#12	/srv/mediawiki/php-1.46.0-wmf.10/index.php(44)	MediaWiki\MediaWikiEntryPoint->run()
#13	/srv/mediawiki/w/index.php(3)	require(string)
#14	{main}

Impact

Notes

Details

Request URL: https://auth.wikimedia.org/metawiki/w/index.php?centralauthLoginToken=*&returnto=*&returntoquery=*&title=*&useformat=*&uselang=*&usesul3=*

Event Timeline

Reedy created this task.Jan 7 2026, 10:50 PM

Restricted Application added a project: MediaWiki-Core-Platform-Team. · View Herald TranscriptJan 7 2026, 10:50 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

9 times in the last 7 days, which is a bit too high for comfort. Most of them are automatic password hash upgrades on login (so no user impact) but 2 of them are on manual password change.

On password hash upgrade, maybe we should just reload the centraluser object (since the code is running in a deferred so CAS conflicts are not that surprising). On manual password change, not sure how it can happen... worth investigating at least.

OWresch-WMF moved this task from Inbox, needs triage to Kanban on the MediaWiki-Core-Platform-Team board.Jan 12 2026, 3:56 PM

OWresch-WMF edited projects, added: MediaWiki-Core-Platform-Team (Kanban); removed: MediaWiki-Core-Platform-Team.

OWresch-WMF moved this task from Essential Work to OKR Work on the MediaWiki-Core-Platform-Team (Kanban) board.Jan 13 2026, 11:02 AM

OWresch-WMF moved this task from OKR Work to Essential Work on the MediaWiki-Core-Platform-Team (Kanban) board.

thcipriani moved this task from Untriaged to Jan–Mar 2026 on the Wikimedia-production-error board.Jan 15 2026, 5:49 PM

Wikimedia\NormalizedException\NormalizedException: Attempted to set global password for {user} but the expected CAS token doesn't match. Possible race condition!Open, Needs TriagePublicPRODUCTION ERRORActions