Unauthorized webdav request gives same message repeated

Steps to reproduce

❯ curl -XPROPFIND http://localhost/remote.php/webdav -u admin:invalid | xmllint --format -
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   488  100   488    0     0   5247      0 --:--:-- --:--:-- --:--:--  5191
<?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
  <s:exception>Sabre\DAV\Exception\NotAuthenticated</s:exception>
  <s:message>Username or password was incorrect, Username or password was incorrect, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured</s:message>
</d:error>

Expected behaviour

Error message Username or password was incorrect, Username or password was incorrect, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured

Actual behaviour

Error message Username or password was incorrect, Username or password was incorrect, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured

Server configuration

Operating system: ubuntu 20.04

Web server: apache

Database: mysql Ver 8.0.23-0ubuntu0.20.04.1 for Linux on x86_64 ((Ubuntu))

PHP version: 7.4

ownCloud version: (see ownCloud admin page) 10.7.0beta2 (git)

Start by reproducing the PROPFIND request against remote.php/webdav with invalid credentials and inspect how the authentication error message is assembled. Trace the repeated authentication causes and verify that the response reports each message only as intended; rerun the curl and xmllint commands to confirm the corrected XML output.