From daaa3a8782dc54ce60a31e3a48737c05dfd6d2b8 Mon Sep 17 00:00:00 2001
From: jack <jack@plutus-32g.local>
Date: Thu, 12 Mar 2026 17:00:01 +0000
Subject: [PATCH 1/3] fix(auth): allow INITIAL_PASSWORD when updating first
 password

---
 src/app/api/settings/route.ts | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/app/api/settings/route.ts b/src/app/api/settings/route.ts
index cb0511c6d8..bcfa59445d 100644
--- a/src/app/api/settings/route.ts
+++ b/src/app/api/settings/route.ts
@@ -60,9 +60,13 @@ export async function PATCH(request) {
           return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
         }
       } else {
-        // First time setting password, no current password needed
-        // Allow empty currentPassword or default "123456"
-        if (body.currentPassword && body.currentPassword !== "123456") {
+        // First-time password set (no DB hash yet).
+        // Accept empty current password, legacy default, or INITIAL_PASSWORD when configured.
+        const initialPassword = process.env.INITIAL_PASSWORD;
+        const currentPassword = body.currentPassword || "";
+        const allowedWithoutHash = ["", "123456", ...(initialPassword ? [initialPassword] : [])];
+
+        if (!allowedWithoutHash.includes(currentPassword)) {
           return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
         }
       }

From e62be7e6b3cac6fdb0356a64f65bd86f846d2356 Mon Sep 17 00:00:00 2001
From: jack <jack@plutus-32g.local>
Date: Thu, 12 Mar 2026 17:04:26 +0000
Subject: [PATCH 2/3] fix(auth): require explicit INITIAL_PASSWORD match on
 first password change

---
 src/app/api/settings/route.ts | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/src/app/api/settings/route.ts b/src/app/api/settings/route.ts
index bcfa59445d..23eb0355d9 100644
--- a/src/app/api/settings/route.ts
+++ b/src/app/api/settings/route.ts
@@ -61,13 +61,24 @@ export async function PATCH(request) {
         }
       } else {
         // First-time password set (no DB hash yet).
-        // Accept empty current password, legacy default, or INITIAL_PASSWORD when configured.
+        const LEGACY_DEFAULT_PASSWORD = "123456";
         const initialPassword = process.env.INITIAL_PASSWORD;
         const currentPassword = body.currentPassword || "";
-        const allowedWithoutHash = ["", "123456", ...(initialPassword ? [initialPassword] : [])];
 
-        if (!allowedWithoutHash.includes(currentPassword)) {
-          return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
+        if (initialPassword) {
+          // If deploy is configured with INITIAL_PASSWORD, require explicit match.
+          if (!currentPassword) {
+            return NextResponse.json({ error: "Current password required" }, { status: 400 });
+          }
+          if (currentPassword !== initialPassword) {
+            return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
+          }
+        } else {
+          // Legacy compatibility: instances without INITIAL_PASSWORD may still use old default.
+          const allowedWithoutHash = ["", LEGACY_DEFAULT_PASSWORD];
+          if (!allowedWithoutHash.includes(currentPassword)) {
+            return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
+          }
         }
       }
 

From 55a9e3193278b4f55bda25d2b36697969a856074 Mon Sep 17 00:00:00 2001
From: jack <jack@plutus-32g.local>
Date: Thu, 12 Mar 2026 17:28:04 +0000
Subject: [PATCH 3/3] fix(auth): use timing-safe compare for INITIAL_PASSWORD
 check

---
 src/app/api/settings/route.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/app/api/settings/route.ts b/src/app/api/settings/route.ts
index 23eb0355d9..28dcdc66f0 100644
--- a/src/app/api/settings/route.ts
+++ b/src/app/api/settings/route.ts
@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { getSettings, updateSettings } from "@/lib/localDb";
 import { clearHealthCheckLogCache } from "@/lib/tokenHealthCheck";
 import bcrypt from "bcryptjs";
+import { timingSafeEqual } from "node:crypto";
 import { getRuntimePorts } from "@/lib/runtime/ports";
 import { updateSettingsSchema } from "@/shared/validation/settingsSchemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
@@ -70,7 +71,14 @@ export async function PATCH(request) {
           if (!currentPassword) {
             return NextResponse.json({ error: "Current password required" }, { status: 400 });
           }
-          if (currentPassword !== initialPassword) {
+
+          const providedBuffer = Buffer.from(currentPassword, "utf8");
+          const expectedBuffer = Buffer.from(initialPassword, "utf8");
+          const isValidInitialPassword =
+            providedBuffer.length === expectedBuffer.length &&
+            timingSafeEqual(providedBuffer, expectedBuffer);
+
+          if (!isValidInitialPassword) {
             return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
           }
         } else {