App password breaks shortly after creation and sessions logged out

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Since a few version (assuming 32.0.3), I'm experiencing troubles when working with Thunderbird as Calendar / Contact client for Nextcloud. It looks like some security logic steps in and finally resets all of my sessions. This used to work for years and stopped working somewhere in a November / December 2025 release.

Steps to reproduce

1. Open Personal Security -> App Passwords
2. Generate an app password, KEEP Dialogue open
3. Enter that password in Thunderbird to sync Calendar with Nextcloud --> everything works fine
4. Close the Dialogue in Nextcloud which generated the app password
5. wait 30 seconds
6. Thunderbird pops up with "enter password for nextcloud.mydomain.com" challenge
7. See other app password-linked logic like Nextcloud Drive client, Talk, Browser sessions etc. --> all logged off
8. restart with 1. and keep dialogue open -> everything works again
9. Check System Security: ip address sometimes officially gets throttled, sometimes not

Expected behavior

Thundbird Syncs are again possible without getting blocked by a security element of Nextcloud.

Nextcloud Server version

33

Operating system

None

PHP engine version

PHP 8.4

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "33.0.0.16",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "twofactor_enforced": "true",
        "mail_smtpmode": "smtp",
        "mail_smtpsecure": "ssl",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "collabora": {
            "timeout": 15,
            "verify_peer": false
        },
        "theme": "",
        "loglevel": 2,
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "memcache.local": "\\OC\\Memcache\\APCu",
        "maintenance_window_start": 1,
        "default_phone_region": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": true,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "app_install_overwrite": [
            "tasks",
            "passwords",
            "appointments"
        ],
        "integrity.check.disabled": false
    }
}

List of activated Apps

Enabled:
  - activity: 6.0.0-dev.0
  - admin_audit: 1.23.0
  - analytics: 6.1.0
  - appointments: 2.6.2
  - brewmemo: 0.6.0
  - bruteforcesettings: 6.0.0-dev.0 (also pops up if this app is deactivated)
  - calendar: 6.2.0
  - circles: 33.0.0
  - cloud_federation_api: 1.17.0
  - comments: 1.23.0
  - contacts: 8.3.3
  - contactsinteraction: 1.14.1
  - dashboard: 7.13.0
  - dav: 1.36.0
  - encryption: 2.21.0
  - federatedfilesharing: 1.23.0
  - federation: 1.23.0
  - files: 2.5.0
  - files_accesscontrol: 4.0.0
  - files_downloadlimit: 5.1.0-dev.0
  - files_pdfviewer: 6.0.0-dev.0
  - files_reminders: 1.6.0
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - fileslibreofficeedit: 2.0.1
  - firstrunwizard: 6.0.0-dev.0
  - forms: 5.2.4
  - fulltextsearch: 33.0.0
  - groupfolders: 21.0.5
  - libresign: 13.0.3
  - logreader: 6.0.0
  - lookup_server_connector: 1.21.0
  - mail: 5.7.0
  - nextcloud_announcements: 5.0.0
  - notes: 4.13.0
  - notifications: 6.0.0
  - notify_push: 1.3.0
  - oauth2: 1.21.0
  - oidc: 1.15.0
  - password_policy: 5.0.0-dev.0
  - passwords: 2025.12.21
  - photos: 6.0.0-dev.0
  - polls: 8.6.3
  - privacy: 5.0.0-dev.0
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - recommendations: 6.0.0-dev.0
  - related_resources: 4.0.0-dev.0
  - richdocuments: 10.1.0
  - serverinfo: 5.0.0-dev.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - spreed: 23.0.1
  - support: 5.0.0
  - survey_client: 5.0.0-dev.0
  - suspicious_login: 11.0.0-dev.0
  - systemtags: 1.23.0
  - tables: 2.0.0
  - tasks: 0.17.1
  - text: 7.0.0-dev.3
  - theming: 2.8.0
  - twofactor_backupcodes: 1.22.0
  - twofactor_nextcloud_notification: 7.0.0
  - twofactor_totp: 15.0.0-dev.0
  - updatenotification: 1.23.0
  - user_status: 1.13.0
  - viewer: 6.0.0-dev.0
  - weather_status: 1.13.0
  - webhook_listeners: 1.5.0
  - whiteboard: 1.5.6
  - workflowengine: 2.15.0
Disabled:
  - app_api: 33.0.0 (installed 32.0.0)
  - assistant: 3.3.0 (installed 3.3.0)
  - end_to_end_encryption: 2.0.0 (installed 2.0.0)
  - files_external: 1.25.1
  - user_ldap: 1.24.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Login attempt with invalid session for username@domain.com
Exception Unable to verify user username@domain.com

Additional info

No response

Start at Personal Security → App Passwords and reproduce the failure with Thunderbird while watching the reported Nextcloud logs for invalid-session and verification messages. Compare the app-password, session, and throttling behavior involving the named suspicious_login and bruteforcesettings apps. Done means Thunderbird remains synchronized after the dialog closes without logging out other clients or triggering an invalid-session failure.