From 4894b70bad5c33c0d7df6f26c1911fd89b1a5d75 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?dni=20=E2=9A=A1?= Date: Fri, 13 Feb 2026 15:44:52 +0100 Subject: [PATCH] fix: `/first_install` new superuser may duplicate an username (#3787) --- lnbits/core/views/auth_api.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lnbits/core/views/auth_api.py b/lnbits/core/views/auth_api.py index ebf2d5596..38c8b2166 100644 --- a/lnbits/core/views/auth_api.py +++ b/lnbits/core/views/auth_api.py @@ -511,15 +511,21 @@ async def update_ui_customization( async def first_install(data: UpdateSuperuserPassword) -> JSONResponse: if not settings.first_install: raise HTTPException(HTTPStatus.FORBIDDEN, "This is not your first install") + if settings.first_install_token: if not data.first_install_token: raise HTTPException(HTTPStatus.UNAUTHORIZED, "Missing first_install_token.") if settings.first_install_token != data.first_install_token: raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid first_install_token.") + account = await get_account_by_username(data.username, False) + if account: + raise HTTPException(HTTPStatus.BAD_REQUEST, "Username already exists.") + account = await get_account(settings.super_user) if not account: raise HTTPException(HTTPStatus.INTERNAL_SERVER_ERROR, "Superuser not found.") + account.username = data.username account.extra = account.extra or UserExtra() account.extra.provider = "lnbits"