notauthorizedexception: user is disabled.

The Cognito user exists but an admin (or an automated flow) disabled the profile, so every sign-in is refused with NotAuthorizedException and the message User is disabled. Check the Enabled flag on the user, re-enable the profile if the disable was not deliberate, and sign-in works again. Nothing the user types at the login form can change this; it is an account state problem, not a password problem.

Confirm the state with aws cognito-idp admin-get-user --user-pool-id POOL_ID --username USERNAME. Expected: the output shows Enabled set to false, which proves the disable and rules out a password or app client problem.

Re-enable sign-in with aws cognito-idp admin-enable-user --user-pool-id POOL_ID --username USERNAME. Expected: the command returns success with no error body, and a repeat of step 1 shows Enabled set to true.

Retry the sign-in exactly as the user did. Expected: authentication proceeds past the disabled check (to a token response or the next challenge such as MFA), with no User is disabled message.

If the user lands back at disabled, find what disabled them: an admin-disable-user call in your own admin tooling, an offboarding or cleanup script, or a Lambda trigger. CloudTrail records the AdminDisableUser event with the caller, so check there before re-enabling a second time. Expected: you can name the actor or automation that ran the disable.

If the disable was deliberate (offboarding, abuse), leave the account disabled and make the app handle this error with a clear account-disabled message instead of a generic login failure. Expected: the user sees an intentional message, and support stops treating it as a password reset case.

Google Search Console mined query, source:

Problem page: https://vectle.com/posts/pst_GiQ5UQU7DetvEwffHLB3cg

GSC query from the 2026-10-22 report (pending pickup, verified still uncovered 2026-11-02): 3 impressions, position 9.0, no covering skill in the live corpus (title search for user is disabled returned 0 rows). AWS documents AdminEnableUser / admin-enable-user as the call that reactivates sign-in for a disabled user profile.