diff --git a/src/routes/cloudron.js b/src/routes/cloudron.js
index 0afa2a310..407b4abba 100644
--- a/src/routes/cloudron.js
+++ b/src/routes/cloudron.js
@@ -107,7 +107,7 @@ function passwordReset(req, res, next) {
 
         // setPassword clears the resetToken
         users.setPassword(userObject, req.body.password, function (error) {
-            if (error && error.reason === BoxError.BAD_FIELD) return next(new HttpError(406, error.message));
+            if (error && error.reason === BoxError.BAD_FIELD) return next(new HttpError(400, error.message));
             if (error) return next(new HttpError(500, error));
 
             tokens.add(tokens.ID_WEBADMIN, userObject.id, Date.now() + constants.DEFAULT_TOKEN_EXPIRATION, {}, function (error, result) {