If you attempt to log on from an IPv6 address and the user does not have “Can only log in from the local network” ticked, it won’t work.
The user settings page doesn’t explain that IPv6 is a “special case” when it comes to what the “local network” is. I can’t actually find any documentation that explains this. There are only two hits on this at www.home-assistant.io:
The log message does not say why the log in attempt failed. It implies it has failed because the credentials are incorrect, but they are not. The components.http.ban bit implies the IP is banned but I have that feature disabled.
2024-05-30 22:48:46.297 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 2001:xx (2001:xx). Requested URL: '/auth/login_flow/902b2021d306a67f0b699365c042c5c9'. (Mozilla/5.0 (Linux; Android 5.1.1; KFFOWI Build/LVY48F; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/59.0.3071.125 Safari/537.36 Home Assistant/2024.4.1-12576 (Android 5.1.1; KFFOWI))