# Bug OP-19184 - Plain text Password received on account creation

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-19184

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module | Authentication, Administration / User administration |
| Target versions | 17.4.0 |
| Observed in versions | 17.2.0 |
| Sprint |  |
| Backlog bucket |  |
| Bug found in version (deprecated) | 17.2.x |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | Yes |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | Oliver Günther |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Steps to reproduce

1.  Login as a user with admin permissions
    
2.  Add a new user [`new_user+github+bot@somedomain.com`](mailto:new_user+github+bot@somegoogleworkspacedomain.com) where `somedomain` is a google workspace domain, same as in the openproject instance `somedomain.openproject.org`
    
3.  Receive an email from <notifications+mfg5ffdb@somedomain.openproject.org>
    
4.  The email contains a plain text password. See screen capture attached (in catalan), basically it says
    

> Information on your new account:
> 
> \* User name:  [new\_user+github+bot@somedomain.com](mailto:new_user+github+bot@somedomain.com)
> 
> \* Password: some\_password\_in\_plain\_text
> 
> >A link to log in follows<

<br>

### What is the buggy behavior?

*   Receiving a plain text password via mail, means it could be accessed in plain text and be readable by unauthorized actors in the long term
    

### What is the expected behavior?

*   Whenever a password is sent out via email, a password change on next log in should be enforced (making sure that the stored plain text in the email is invalidated
    

###   

### **Logs**

NA

### Screenshots and other files

<img class="op-uc-image op-uc-image_inline" src="/api/v3/attachments/920361/content">

### Environment information

*   Hosted cloud edition for somenergia.coop
    

**OpenProject version**  
**Core build**  
**29545d3003d46a4e054300f45cfb843173105926**  
**Product version**  
**022dfe063e5c2bfa7bac18d40141fcb715bd8e3c**  
**Base version**  
**OpenProject 17.2.3**  
**Versió PostgreSQL**  
**17.5**  
**Last change**  
**03/30/2026 10:45 AM**