0.6.1 Onboarding/Login POST /login.data → 400 Bad Request

[gitepyc]

Describe the bug
After upgrading from 0.6.0 to 0.6.1, the frontend login and onboarding both fail, a POST to /login.data always returns 400 Bad Request.
Even on a completely fresh installation with a new admin user, a POST to /onboarding.data returns 400 Bad Request.
Downgrading to 0.6.0 resolved the issue entirely.

To Reproduce
Fresh setup (no backups, empty config directory):
1.
mkdir -p /data/appdata/nzbdav/config
docker run -d
--name nzbdav
-e PUID=1000
-e PGID=1000
-e NZBDAV_ADMIN_USER=nzbadmin
-e NZBDAV_ADMIN_PASS=Test123
-v /data/appdata/nzbdav/config:/app/config
-p 3000:3000
nzbdav/nzbdav:alpha # 0.6.1 / alpha

2. Open the frontend in a browser (http://:3000)

3. Attempt onboarding or login with nzbadmin / Start123

4. Observe logs:

Error: Bad Request
at singleFetchAction (file:///app/frontend/node_modules/react-router/dist/development/chunk-JPUPSTYD.mjs:854:31)
...
POST /onboarding.data 400 - - 3.108 ms

Expected behavior
POST /login.data should login the user
POST /onboarding.data should create the admin user (on fresh install) or allow login, no 400 Error.

Frontend login should work on both fresh and existing installations.

Actual behavior
POST /onboarding.data returns 400 Bad Request

Frontend shows "App Error"

Logs contain React Router stacktrace (singleFetchAction)

Screenshots

Additional context
Issue occurs only in 0.6.1 / alpha / latest 6.x

0.6.0 works perfectly

Container tested without reverse proxy, direct port mapping (-p 3000:3000)

Browser cache and cookies cleared; fresh config directory → issue persists

DB/config directory (/app/config) was completely new, no old data

System / Env:
Host: Linux, Docker 24.x, Docker Compose v2

Image: nzbdav/nzbdav:alpha (0.6.1) → fails

Image: nzbdav/nzbdav:0.6.0 → works

Ports: 3000:3000

---

NOTE:
NZBDAV is intended for use with legally obtained content only. The project maintainers do not condone piracy and will not provide support for users suspected of engaging in copyright infringement. Issues related to or suspected of piracy will be closed.