From 001df38f1f7adcc89748dd3a9d4f56fff93194e7 Mon Sep 17 00:00:00 2001
From: Smeet Agrawal <141252618+Smeet23@users.noreply.github.com>
Date: Sun, 12 Apr 2026 14:04:17 +0530
Subject: [PATCH] fix: add max password length validation (128 chars) to
 NewUserRequest

---
 litellm/proxy/_types.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index 76508ebac78..fa735fc3cdd 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -1432,6 +1432,8 @@ class NewUserRequest(GenerateRequestBase):
     def validate_password(cls, v: Optional[str]) -> Optional[str]:
         if v is not None and len(v) < 8:
             raise ValueError("password must be at least 8 characters")
+        if v is not None and len(v) > 128:
+            raise ValueError("password must be at most 128 characters")
         return v