From 170ec28a1ae0af65772b5ac53d742eb118e21e50 Mon Sep 17 00:00:00 2001
From: G30 <50341825+silentoplayz@users.noreply.github.com>
Date: Sat, 10 Oct 2026 12:10:39 -0400
Subject: [PATCH] fix: name the secret key when stored MFA secrets cannot be
 decrypted at startup (#32189)

---
 backend/open_webui/utils/mfa.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/backend/open_webui/utils/mfa.py b/backend/open_webui/utils/mfa.py
index dcd74c38b9..777e0ce63e 100644
--- a/backend/open_webui/utils/mfa.py
+++ b/backend/open_webui/utils/mfa.py
@@ -410,7 +410,13 @@ async def validate_mfa_configuration(config: MfaConfigForm | None = None):
             if value is not None:
                 mfa = MfaData.model_validate(value)
                 if mfa.secret:
-                    decrypt_secret(mfa.secret)
+                    try:
+                        cipher().decrypt(mfa.secret.encode())
+                    except InvalidToken:
+                        raise ValueError(
+                            'Stored MFA secrets cannot be decrypted. '
+                            'Restore the WEBUI_SECRET_KEY or MFA_ENCRYPTION_KEY they were encrypted with.'
+                        ) from None
 
 
 async def update_mfa_config(request, updates: dict) -> bool: