[Bug / Issue] 'No valid password configured' - error - Vbulletin 5.6.2 Security Patch Level 1

[Archetribe]

Dear support staff,

On my forum https://archetribe.com/ I get the following error any time I (or any other user of the forum) attempt(s) to log in as a normal/admin user:
"You do not have a valid password configured for your account. Please reset your password via the reset password link."
(it does not matter if I try to log in on the admincp or not, neither the normal nor the admincp login work.)

Relevant information:
Vbulletin version: 5.6.2 (Security patch level 1)
PHP version: 7.4.5 (retrieved from a phpinfo.php file in the server root as I have no admincp access due to the login problem)
mySQL version: 10.1.46-MariaDB (this is the version running on the VPS server)

Tech support from my hosting provider has checked for any server-side issues that could cause this, but they cannot find any. This login-related error started happening after the server was migrated to a new hosting provider. I was suspicious of server-side issues, but they have also remigrated the vbulletin related files and the databases to see if that would fix the problem. It did not. They also ran the following check:



The Hosting service tech support recommended me to look for support from vbulletin tech staff as they thought it might be a bug in the vbulletin software. They say they have tried a multitude of solutions that are posted here on the forum, but all to no avail. There were no error logs on the server itself and it does not matter which browser I use, whether it is Firefox, chrome or Brave. Clearing the browser cache does not solve the issue.

Turning on debug options for a short while, there was the following information:

 Debug Information
Page ID: 1
Parent ID: 0
Page Template ID: 1
Route ID: 7
Page Type: default
Screen Layout ID: 1
Screen Layout Template: screenlayout_display_full
Channel ID: 1
Node ID:
Database Asserts: 95 (?)
AJAX Requests: 2
Facebook Active: No (Not enabled or no appid & secret set)
Style ID: 38
Templates/Renders: 30/52
CSS Templates: 4
JS Files: 4
Included Files: 160
Autoloaded Classes: 160
Current Time: Mon, 24 Aug 2020 14:14:21 +0000
Page Time: 0.2954

What also does not work is the 'I forgot my password' feature. That feature already did not work before the migration (in all other aspects the vbulletin software was operating swimmingly), but I assumed that was the bug discussed here (on this forum) to be fixed in the next vbulletin stable version. I do not know if that's related, but i thought it was worth mentioning, as I can't change my password to a new and 'valid' one this way either.

See attachments for screenshots of the error in the admincp and on the regular login screen, they are named accordingly.

If there's any extra information you require for solving the problem, please tell me and I'll be happy to provide it. I hope you will be able to figure out how to solve this issue.

[Wayne Luke]

This error happens when you had Argon2id support and do not anymore. If you have switched PHP versions, you should make sure that the Argon library is installed and that PHP knows where it resides on the server.

https://www.php.net/manual/en/password.installation.php

If you're using a Debian derivative then this article might help: https://framework.zend.com/blog/2017...-password.html

Alternatively, you can request a new password link and change your password. The changed password will be stored using Blowfish. However, Argon2id is considered to be the most secure password hash in PHP right now.

[Archetribe]

Argon2id has now been enabled on the server and php can find it:



The same error, however, still appears. We can unfortunately not request a new password link, as that feature was already not working before server migration.
When a password is requested on our website, the following error message appears:

[Wayne Luke]

What are the contents of your /core/includes/xml/pwschemes_vbulletin.xml file?

That error should occur after the request is sent to the server. You should still receive a reset password link via email.

The only other way around this is to create a new user and then elevate them to an Administrator account using tools.php. The instructions on using tools.php are available here: https://forum.vbulletin.com/articles...sing-tools-php

[Archetribe]

What are the contents of your /core/includes/xml/pwschemes_vbulletin.xml file?

The contents are the following:

<?xml version="1.0" encoding="ISO-8859-1"?>
<schemes>
    <scheme name='argon2id:::' priority='20' />
    <scheme name='blowfish:15' priority='10' />
    <scheme name='blowfish:10' priority='' />
    <scheme name='legacy' priority='' />
</schemes>

Ah, yeah I did in fact receive a mail when trying to reset my e-mail account it was sent to my spam folder, so I hadn't noticed it. I have access to my admin panel now, as I could change my password. Thanks for your help!

What I am wondering about now is what exactly causes this issue? argon2id is now enabled so it should work, but users that already have an account on archetribre.com all need to reset their passwords as they will get the exact same error.

[Wayne Luke]

That is the literal contents of the file?

Every &lt; should be a < and every &gt; should be a > for this to be a valid file.

Not sure how this could have gotten HTML encoded on your server. Did you upload these files with a proper SFTP client?

[Archetribe]

That is the literal contents of the file?

Every &lt; should be a < and every &gt; should be a > for this to be a valid file.

Not sure how this could have gotten HTML encoded on your server. Did you upload these files with a proper SFTP client?

Ah no those are not its literal contents and I used FileZilla. It looks the way it should be on the server, according to what you're describing. I think something went wrong with the encoding after I copied and pasted this from one text editor to another. Regardless, it looks like this on the server itself:

[Wayne Luke]

Okay. The image is how it should look in a text editor. I didn't know if I had to investigate another bug or not.