Password change triggers password validation after saving

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When changing the password from the Web UI with a new password that respects the password policy, the new password is saved but a wrong warning "Password must be at least 10 characters long" is shown to the user.

Steps to reproduce

1. Connect to the Web UI, security section
2. Type in a password that fulfills the policy

3. Password is updated but user gets a wrong warning

Expected behavior

No warning is shown when entering a policy-compliant password

Nextcloud Server version

33

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

None

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "my.domain.com",
            "10.0.ZZ.KK"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "33.0.2.2",
        "overwrite.cli.url": "https:\/\/my.domain.com",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "htaccess.RewriteBase": "\/",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": "0",
            "timeout": "0.0",
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "memcache.local": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": "true",
        "overwriteprotocol": "https",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "admin",
            "rcasys_admin"
        ],
        "twofactor_enforced_excluded_groups": [],
        "remember_login_cookie_lifetime": 0,
        "session_lifetime": 7200,
        "session_keepalive": false,
        "auto_logout": true,
        "enable_previews": true,
        "upgrade.disable-web": true,
        "defaultapp": "",
        "auth.webauthn.enabled": false,
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "loglevel": 2,
        "log_type": "file",
        "logtimezone": "Europe\/Madrid",
        "default_phone_region": "es",
        "maintenance": false,
        "maintenance_window_start": 1,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "logfile_audit": "\/var\/log\/nextcloud\/audit.log",
        "app_install_overwrite": [
            "fulltextsearch",
            "fulltextsearch_elasticsearch",
            "files_fulltextsearch"
        ],
        "enabledPreviewProviders": {
            "1": "OC\\Preview\\GIF",
            "2": "OC\\Preview\\JPEG",
            "3": "OC\\Preview\\PNG"
        }
    }
}

List of activated Apps

Enabled:
  - activity: 6.0.0
  - admin_audit: 1.23.0
  - app_api: 33.0.0
  - assistant: 3.3.0
  - bruteforcesettings: 6.0.0
  - calendar: 6.2.2
  - circles: 33.0.0
  - cloud_federation_api: 1.17.0
  - collectives: 4.2.0
  - contacts: 8.4.3
  - dashboard: 7.13.0
  - dav: 1.36.0
  - deck: 1.17.0
  - federatedfilesharing: 1.23.0
  - federation: 1.23.0
  - files: 2.5.0
  - files_downloadlimit: 5.1.0
  - files_fulltextsearch: 33.0.0
  - files_lock: 33.0.1
  - files_pdfviewer: 6.0.0
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - firstrunwizard: 6.0.0
  - forms: 5.2.5
  - fulltextsearch: 33.0.0
  - fulltextsearch_elasticsearch: 33.0.0
  - groupfolders: 21.0.6
  - impersonate: 4.0.0
  - integration_openai: 4.3.1
  - lookup_server_connector: 1.21.0
  - mail: 5.7.6
  - nextcloud_announcements: 5.0.0
  - notifications: 6.0.0
  - notify_push: 1.3.1
  - oauth2: 1.21.0
  - password_policy: 5.0.0
  - privacy: 5.0.0
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - richdocuments: 10.1.2
  - serverinfo: 5.0.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - spreed: 23.0.3
  - support: 5.0.0
  - systemtags: 1.23.0
  - text: 7.0.0
  - theming: 2.8.0
  - twofactor_backupcodes: 1.22.0
  - twofactor_totp: 15.0.0
  - updatenotification: 1.23.0
  - viewer: 6.0.0
  - webhook_listeners: 1.5.0
  - workflowengine: 2.15.0
Disabled:
  - comments: 1.23.0 (installed 1.17.0)
  - contactsinteraction: 1.14.1 (installed 1.8.0)
  - encryption: 2.21.0 (installed 2.18.0)
  - files_external: 1.25.1 (installed 1.23.0)
  - files_reminders: 1.6.0 (installed 1.0.0)
  - fulltextsearch_elasticsearch-master: 32.0.0
  - logreader: 6.0.0 (installed 2.12.0)
  - photos: 6.0.0 (installed 2.3.0)
  - recommendations: 6.0.0 (installed 1.6.0)
  - related_resources: 4.0.0 (installed 1.2.0)
  - survey_client: 5.0.0 (installed 1.15.0)
  - suspicious_login: 11.0.0
  - testing: 1.23.0
  - twofactor_nextcloud_notification: 7.0.0
  - user_ldap: 1.24.0
  - user_status: 1.13.0 (installed 1.7.0)
  - weather_status: 1.13.0 (installed 1.7.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

There is no log entry relevant to this event with loglevel=2

Additional info

No response

Start at the Web UI security section and trace the password change flow alongside the password_policy app, comparing the policy-compliant password validation with the warning shown after saving. Done means a compliant password is saved without displaying the incorrect minimum-length warning; reproduce the reported steps to verify the behavior.