[BUG] Internal Server Error when using Reset Password feature

[wowedwin]

Self Checks

• I have read the Contributing Guide and Language Policy.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

Dify version

1.13.3

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

I am currently using version 1.13.1. When I attempt to use the 'Forgot your password?' feature, I immediately receive an 'Internal Server Error'.
[root@Node2 docker]# docker-compose logs -f api
api-1 | 2026-04-23 06:56:13.177 INFO [Dummy-63] [_client.py:1025] a571779e6b655158b135e100f9218a32 - HTTP Request: GET http://plugin_daemon:5002/plugin/1bebe67d-5198-4a56-8d17-2b1edb3455f2/management/models?page=1&page_size=256 "HTTP/1.1 200 OK"
api-1 | 2026-04-23 06:56:13.178 INFO [Dummy-64] [_client.py:1025] 5ae7085eb95b5898a59ae836b99f6d2b - HTTP Request: GET http://plugin_daemon:5002/plugin/1bebe67d-5198-4a56-8d17-2b1edb3455f2/management/models?page=1&page_size=256 "HTTP/1.1 200 OK"
api-1 | 2026-04-23 06:56:13.326 INFO [Dummy-65] [_client.py:1025] abdffad8a9b85669ae3d65b23dbca9f6 - HTTP Request: GET http://plugin_daemon:5002/plugin/1bebe67d-5198-4a56-8d17-2b1edb3455f2/management/models?page=1&page_size=256 "HTTP/1.1 200 OK"
api-1 | 2026-04-23 06:56:13.335 INFO [Dummy-66] [_client.py:1025] 7ccc7fa3d2725f16a735d16e4cb0de3d - HTTP Request: GET http://plugin_daemon:5002/plugin/1bebe67d-5198-4a56-8d17-2b1edb3455f2/management/models?page=1&page_size=256 "HTTP/1.1 200 OK"
api-1 | 2026-04-23 06:56:13.465 INFO [Dummy-67] [_client.py:1025] 14ceb48ea64050e29cdeb8d827642883 - HTTP Request: GET http://plugin_daemon:5002/plugin/1bebe67d-5198-4a56-8d17-2b1edb3455f2/management/install/tasks?page=1&page_size=100 "HTTP/1.1 200 OK"
api-1 | 2026-04-23 06:56:13.548 INFO [Dummy-68] [_client.py:1025] 66412559ee0a5ac7b8af931ce8a676b7 - HTTP Request: GET http://plugin_daemon:5002/plugin/1bebe67d-5198-4a56-8d17-2b1edb3455f2/management/models?page=1&page_size=256 "HTTP/1.1 200 OK"
api-1 | 2026-04-23 06:56:14.384 INFO [Dummy-69] [client.py:1025] f606795ca76c5bc097b52fbcbd5d330b - HTTP Request: GET https://updates.dify.ai?current_version=1.13.3 "HTTP/1.1 200 OK"
api-1 | 2026-04-23 06:56:21.134 ERROR [Dummy-70] [app.py:875] 9116e6bb437c52b29115c933d37da3f7 - Exception on /console/api/forgot-password [POST]
api-1 | Traceback (most recent call last):
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/flask/app.py", line 917, in full_dispatch_request
api-1 | rv = self.dispatch_request()
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/flask/app.py", line 902, in dispatch_request
api-1 | return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args) # type: ignore[no-any-return]
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/flask_restx/api.py", line 404, in wrapper
api-1 | resp = resource(*args, **kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/flask/views.py", line 110, in view
api-1 | return current_app.ensure_sync(self.dispatch_request)(**kwargs) # type: ignore[no-any-return]
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/flask_restx/resource.py", line 41, in dispatch_request
api-1 | resp = meth(*args, **kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/controllers/console/wraps.py", line 227, in decorated
api-1 | return view(*args, **kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/controllers/console/wraps.py", line 249, in decorated
api-1 | return view(*args, **kwargs)
api-1 | ^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/controllers/console/auth/forgot_password.py", line 108, in post
api-1 | token = AccountService.send_reset_password_email(
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/services/account_service.py", line 481, in send_reset_password_email
api-1 | account_email = account.email if account else email
api-1 | ^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/sqlalchemy/orm/attributes.py", line 569, in get
api-1 | return self.impl.get(state, dict) # type: ignore[no-any-return]
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/sqlalchemy/orm/attributes.py", line 1096, in get
api-1 | value = self._fire_loader_callables(state, key, passive)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/sqlalchemy/orm/attributes.py", line 1126, in _fire_loader_callables
api-1 | return state._load_expired(state, passive)
api-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/sqlalchemy/orm/state.py", line 828, in _load_expired
api-1 | self.manager.expired_attribute_loader(self, toload, passive)
api-1 | File "/app/api/.venv/lib/python3.12/site-packages/sqlalchemy/orm/loading.py", line 1607, in load_scalar_attributes
api-1 | raise orm_exc.DetachedInstanceError(
api-1 | sqlalchemy.orm.exc.DetachedInstanceError: Instance <Account at 0xffff54e7f1d0> is not bound to a Session; attribute refresh operation cannot proceed (Background on this error at: https://sqlalche.me/e/20/bhk3)

✔️ Expected Behavior

After clicking "Forgot your password?", the user should be able to enter their email address.
The system should successfully send a reset link or verification code to the user's email.
The page should then redirect to the verification code input screen.

❌ Actual Behavior

error report: Internal Server Error

[dosubot]

Hi @wowedwin! I'm Dosu and I’m helping the dify team.

This is a known bug in v1.13.3 caused by a session management refactoring in PR #33966. The Account object returned by get_account_by_email_with_case_fallback becomes detached from the SQLAlchemy session before send_reset_password_email tries to access account.email, which triggers the DetachedInstanceError [1].

The fix has already been merged in PR #34904 (April 10, 2026), which refactors get_account_by_email_with_case_fallback to properly manage its own session lifecycle and re-attach objects where needed [2].

To resolve this, upgrade to a Dify version that includes PR #34904.

If you can't upgrade immediately, you can apply this workaround by editing api/services/account_service.py — find get_account_by_email_with_case_fallback and change its session creation to use expire_on_commit=False:

with session_factory.create_session(expire_on_commit=False) as session:

This prevents SQLAlchemy from expiring the object's cached attributes after the session closes, allowing account.email to be accessed safely.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.