{
  "id": 1949057,
  "title": "The Bug That Turned Every Bad Password Into a Server Outage",
  "url": "https://urgent.news/2026/08/19/the-bug-that-turned-every-bad-password-into-a-server-outage",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-19T13:50:30.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cloudwiseteam/the-bug-that-turned-every-bad-password-into-a-server-outage-4dda"
  },
  "original_language": "en",
  "account": "When CloudWise users typed in the wrong password on its login page, the server responded with an HTTP 500 error code, indicating an internal server error. This happened on both staging and production environments, regardless of whether the email address was unknown, the account was unconfirmed, or the account was mid-password-reset. The bug was caused by the handle_cognito_auth_error function, which translated AWS Cognito's authentication errors into HTTP responses but failed to set a status code, causing the default 500 error to be returned for all error cases. This resulted in incorrect information being sent to infrastructure, such as monitoring dashboards, which counted 5xx error rates as a sign of an outage. The bug also caused routine login errors to be logged at error level, even when the user simply needed to try again. This led to unnecessary human intervention and prevented a production release from being promoted. The issue was detected when an automated gate caught it and blocked the release from being pushed to production. The fix involved mapping Cognito's exceptions to the appropriate status codes: NotAuthorizedException and UserNotFoundException to 401, UserNotConfirmedException and PasswordResetRequiredException to 403, and any other unexpected errors to 500. This ensured that the login error handling behaved normally and prevented the server from returning a 500 error for routine login failures.",
  "summary": "Type your password wrong on CloudWise's login page, and for a while, the server told you it had a nervous breakdown. Not \"invalid credentials.\" Not even a plain 401. An HTTP 500 — the code reserved for \"something on our end is broken\" — for the most routine failure mode there is: a human mistyping a password. This happened on staging. It happened on production. It happened to POST…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}