diff --git a/src/routes/auth.js b/src/routes/auth.js
index 18f974f..94054fa 100644
--- a/src/routes/auth.js
+++ b/src/routes/auth.js
@@ -309,7 +309,13 @@ router.post('/login', async (req, res) => {
       return res.status(401).json({ error: 'Invalid credentials' });
     }
 
-    var valid = await passwords.verify(password, user.password);
+    var valid;
+    try {
+      valid = await passwords.verify(password, user.password);
+    } catch (verifyErr) {
+      console.error('[Auth] passwords.verify threw:', verifyErr.message);
+      return res.status(500).json({ error: 'Request failed' });
+    }
     if (!valid) {
       await db.run('INSERT INTO audit_log (user_id, action, ip_address) VALUES (?, ?, ?)', [user.id, 'login_failed', req.ip]).catch(function(){});
       return res.status(401).json({ error: 'Invalid credentials' });