diff --git a/src/login/service.ts b/src/login/service.ts
index 3ddeb426..c9caa457 100644
--- a/src/login/service.ts
+++ b/src/login/service.ts
@@ -230,6 +230,16 @@ async function challengeUsernamePassword(session: LoginSession, username: string
     );
   }
 
+  const { success, errorMessage } = await services.user.validateUserCredentials(user, password, ctx);
+  if (!success && errorMessage) {
+    throw new A12nLoginChallengeError(
+      session,
+      errorMessage,
+      'username-password',
+      true,
+    );
+  }
+
   session.principalId = user.id;
   session.passwordValid = true;
   session.dirty = true;
@@ -251,16 +261,6 @@ async function challengeUsernamePassword(session: LoginSession, username: string
     );
   }
 
-  const { success, errorMessage } = await services.user.validateUserCredentials(user, password, ctx);
-  if (!success && errorMessage) {
-    throw new A12nLoginChallengeError(
-      session,
-      errorMessage,
-      'username-password',
-      true,
-    );
-  }
-
   return user;
 }