Forms Authentication `-ErrorMessage` Is Ignored And Always Displays "Bad username or password"

[eizedev]

Summary

When using custom Forms Authentication in PowerShell Universal 2026.1.6 (could also be the same for older version, not tested), the custom error message returned via New-PSUAuthenticationResult -ErrorMessage is ignored.

The login page always displays the default message:

Bad username or password

instead of the custom message returned by the authentication script.

---

Expected Behavior

The login UI should display the exact message passed to:

New-PSUAuthenticationResult -ErrorMessage 'Permission denied.'

Example use cases:

• Invalid credentials
• Valid credentials but missing authorization groups
• Account restrictions
• Custom authentication providers

---

Actual Behavior

Regardless of the returned -ErrorMessage, the PSU login form always shows:

Bad username or password

The authentication script itself works correctly and logs the expected result internally.

---

Example

Authentication script:

Set-PSUAuthenticationMethod -Type 'Form' -ScriptBlock {
    param($Credential)

    if ($Credential.UserName -eq 'Adam') {
        New-PSUAuthenticationResult -Success -UserName 'Adam'
    }
    else {
        New-PSUAuthenticationResult -ErrorMessage 'Not Adam!'
    }

}

Expected UI message:

Not Adam!

Actual UI message:

Bad username or password

---

Additional Notes

The issue occurs during Forms Authentication.

The internal authentication logic and logging work correctly.
Only the displayed UI error message seems to be overridden internally.

This makes it impossible to distinguish between:

• invalid credentials
• valid credentials without permissions
• other authentication/authorization failures

from the user perspective.

Version

2026.1.6

Severity

Medium

Hosting Method

IIS

Operating System

Windows

Database

SQLite

Licensed

Yes

Features

No response

Additional Environment data

No response

Screenshots/Animations

No response