diff --git a/apps/users/views/user.py b/apps/users/views/user.py
index 046d4dec933..53a3f4a224b 100644
--- a/apps/users/views/user.py
+++ b/apps/users/views/user.py
@@ -399,8 +399,13 @@ class RePasswordView(APIView):
     def post(self, request: Request):
         request_data = request.data
         if request_data.get("encrypted", False):
-            request_data["password"] = decrypt(request_data.get("password"))
-            request_data["re_password"] = decrypt(request_data.get("re_password"))
+            # 前端对 password/re_password 先做 JSON.stringify 再 RSA 加密，解密后需反序列化
+            # 还原真实明文；否则会把带引号的 JSON 字符串当成密码存库，导致登录校验失败。
+            try:
+                request_data["password"] = json.loads(decrypt(request_data.get("password")))
+                request_data["re_password"] = json.loads(decrypt(request_data.get("re_password")))
+            except Exception:
+                raise AppApiException(500, _("Invalid encrypted data"))
         serializer_obj = RePasswordSerializer(data=request_data)
         return result.success(serializer_obj.reset_password())
 
diff --git a/ui/src/views/login/forgot-password/index.vue b/ui/src/views/login/forgot-password/index.vue
index f706eed7022..17f81d328a9 100644
--- a/ui/src/views/login/forgot-password/index.vue
+++ b/ui/src/views/login/forgot-password/index.vue
@@ -94,12 +94,16 @@ const handleResetPassword = async () => {
       const encryptor = new JSEncrypt()
       encryptor.setPublicKey(auth.baseProfile?.rsa ?? '')
       const { confirmPassword: re_password, email, password, verificationCode: code } = forgotPasswordForm
-      const encryptedData = encryptor.encrypt(JSON.stringify({ password, re_password }))
+      const encryptedData = encryptor.encrypt(JSON.stringify(password))
       if (!encryptedData) {
         return
       }
+      const encryptedRePassword = encryptor.encrypt(JSON.stringify(re_password))
+      if (!encryptedRePassword) {
+        return
+      }
 
-      await ForgotPasswordApi.postResetPassword({ code, email, password: encryptedData, re_password: encryptedData, encrypted: true })
+      await ForgotPasswordApi.postResetPassword({ code, email, password: encryptedData, re_password: encryptedRePassword, encrypted: true })
       MsgSuccess('密码修改成功，请使用新密码登录')
       router.push({ name: 'login' })
     } finally {