diff --git a/lnbits/core/views/auth_api.py b/lnbits/core/views/auth_api.py
index 0c19cc592..807017426 100644
--- a/lnbits/core/views/auth_api.py
+++ b/lnbits/core/views/auth_api.py
@@ -246,7 +246,7 @@ async def update_password(
             status_code=HTTPStatus.NOT_FOUND, detail="Account not found."
         )
 
-    # old accounts do not have a pasword
+    # old accounts do not have a password
     if account.password_hash:
         if not data.password_old:
             raise HTTPException(
@@ -260,7 +260,10 @@ async def update_password(
     account.username = data.username
     account.hash_password(data.password)
     await update_account(account)
-    return await get_user(account)
+    _user = await get_user(account)
+    if not _user:
+        raise HTTPException(status_code=HTTPStatus.NOT_FOUND, detail="User not found.")
+    return _user
 
 
 @auth_router.put("/reset")
diff --git a/lnbits/decorators.py b/lnbits/decorators.py
index 855e1bf38..a5dbaf2fa 100644
--- a/lnbits/decorators.py
+++ b/lnbits/decorators.py
@@ -152,6 +152,8 @@ async def check_user_exists(
         raise HTTPException(HTTPStatus.UNAUTHORIZED, "User not allowed.")
 
     user = await get_user(account)
+    if not user:
+        raise HTTPException(HTTPStatus.UNAUTHORIZED, "User not found.")
     await _check_user_extension_access(user.id, r["path"])
     return user