/auth/v1/users/me returns HTTP 500 instead of 401 for unauthenticated requests (Zitadel Cloud)

❌Unsolved🪲Bugs

Calling

GET /auth/v1/users/me

GET /auth/v1/users/me

without an authorization header now returns HTTP 500
with a gRPC error body instead of HTTP 401.

Response body
{"code":2,"message":"rpc error: code = Unauthenticated desc = auth header missing ()","details":[{"@type":"type.googleapis.com/zitadel.v1.ErrorDetail","message":"rpc error: code = Unauthenticated desc = auth header missing"}]}

Expected behavior
HTTP 401 Unauthorized (as it was before ~Feb 16, 2026)

Environment
- Zitadel Cloud
- Endpoint: /auth/v1/users/me
- No authorization header sent

Timeline
- Working correctly (returning 401): Feb 5, 2026
- Broken (returning 500): Feb 25, 2026
- Zitadel v4.11.0 was released Feb 16, 2026 — likely the trigger

/auth/v1/users/me returns HTTP 500 instead of 401 for unauthenticated requests (Zitadel Cloud)

Similar Threads