Broken password/header auth in cloud-managed account with self-hosted cluster

[Bajahaw]

Before posting

• I searched existing discussions and issues, including closed ones, and checked the relevant docs.
• I believe this is a product bug rather than a configuration or setup question.
• I can reproduce this issue, or for intermittent issues I've included trigger, frequency, and timing details below.
• I removed or anonymized sensitive data from logs, screenshots, and configuration.

Affected area

Login / Authentication / IdP

Deployment type

NetBird Cloud

Operating system or environment

Linux

NetBird version and upgrade status

v0.74.4

Did this work before?

Yes, this worked before

Regression details

Services auth was working fine, until I setup a self-hosted proxy/cluster, all auth methods stopped working, Netbird-only access. was never enabled.

All other methods, returning 400 err: invalid session token

If Netbird-only access is enabled, it works fine

Summary

Password, PIN, and header service authentication methods are broken, (I did not try SSO). Netbird-only access works.

Current behavior

400 error on every login try, on multiple devices, including Chrome and Curl. I tried changing auth method, recreating service, recreating the cluster, changing the domain, the issue still persist.

Expected behavior

Correct authentication workflow?

Steps to reproduce

• free cloud account
• setup self-hosted cluster/proxy
• add service with auth method other than Netbird-only access.
• try to login
• 400

Environment and topology

• Netbird Cloud account + Oracle free tier vps with public IP, open ports 443/80.

Self-hosted details, if available

• Self hosted cluster using docker command provided in management UI

Logs, status output, or debug evidence

2026-07-12T12:26:20.484Z DEBG proxy/internal/tcp/router.go:323: SNI router accepted conn from [REDACTED_CLIENT_IP]:[REDACTED_PORT] on [REDACTED_PROXY_IP]:443
2026-07-12T12:26:20.490Z DEBG [remote: [REDACTED_CLIENT_IP]:[REDACTED_PORT], sni: [REDACTED_HOST], match: true, tls: true] proxy/internal/tcp/router.go:383: SNI route lookup
2026-07-12T12:26:20.490Z DEBG proxy/internal/tcp/router.go:390: SNI "[REDACTED_HOST]" routed to HTTP handler (service_id=[REDACTED_SERVICE_ID])
2026-07-12T12:26:20.544Z DEBG proxy/internal/accesslog/middleware.go:28: request: request_id=[REDACTED_REQUEST_ID] method=POST host=[REDACTED_HOST] path=/
2026-07-12T12:26:20.544Z DEBG proxy/internal/auth/middleware.go:112: checking authentication for host: [REDACTED_HOST], exists: true
2026-07-12T12:26:20.628Z DEBG proxy/internal/accesslog/middleware.go:88: response: request_id=[REDACTED_REQUEST_ID] method=POST host=[REDACTED_HOST] path=/ status=400 duration=83ms source=[REDACTED_CLIENT_IP] origin=[REDACTED_ORIGIN] service=[REDACTED_SERVICE_ID] account=[REDACTED_ACCOUNT_ID]

Related issues or discussions

No response

Impact

• Complete inaccessibility of services

Additional context

No response

[Bajahaw]

anybody? any idea? is it only me? should i open an issue?