#2595·mailinabox

Non-ascii characters in password prevent control panel login

Author: kiekerjanCreated Jul 22, 2026Updated Aug 12, 2026

It is possible to set a password which prevents login into the control panel. Steps to reproduce:

  1. The user sets a password in Roundcube. The password contains a non-ascii character, e.g. €
  2. The user tries to login to the control panel (box.domain/admin)
  3. A vague error is reported
  4. The user is not allowed in

Furthermore:

  • After step 1, the user can still login into Roundcube
  • Step 1 can also be performed by setting a password in the control panel. It is accepted, and can be used to login into Roundcube

The error seems to be raised by the following line of code: base64.b64decode(s.encode('ascii')).decode('ascii')

I did a little debugging and I think the following line is needed in auth.py return base64.b64decode(s.encode('ascii')).decode('utf-8')

Furthermore, the base64encode function in template/index.html would become something like function base64encode(input) { return btoa(unescape(encodeURIComponent(input))); }

It works for me (tm) but any thoughts on these changes by others?

Thanks for reporting user Kuabi at the forum

Source: mail-in-a-box/mailinabox