diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php
index 70b77bf3c0..c205a4beca 100644
--- a/app/controllers/api/account.php
+++ b/app/controllers/api/account.php
@@ -119,7 +119,7 @@ App::post('/v1/account')
             }
         }
 
-        $hooks->trigger('passwordValidator', [$project, $password, $user]);
+        $hooks->trigger('passwordValidator', [$project, $password, &$user]);
 
         $passwordHistory = $project->getAttribute('auths', [])['passwordHistory'] ?? 0;
         $password = Auth::passwordHash($password, Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS);
@@ -1915,7 +1915,7 @@ App::patch('/v1/account/password')
             }
         }
 
-        $hooks->trigger('passwordValidator', [$project, $password, $user]);
+        $hooks->trigger('passwordValidator', [$project, $password, &$user]);
 
         $user
             ->setAttribute('password', $newPassword)
diff --git a/app/controllers/api/users.php b/app/controllers/api/users.php
index 91eb47822d..d3679bdea0 100644
--- a/app/controllers/api/users.php
+++ b/app/controllers/api/users.php
@@ -99,7 +99,7 @@ function createUser(string $hash, mixed $hashOptions, string $userId, ?string $e
             'search' => implode(' ', [$userId, $email, $phone, $name]),
         ]);
 
-        $hooks->trigger('passwordValidator', [$project, $password, $user]);
+        $hooks->trigger('passwordValidator', [$project, $password, &$user]);
 
         $password = (!empty($password)) ? ($hash === 'plaintext' ? Auth::passwordHash($password, $hash, $hashOptionsObject) : $password) : null;
         $user = $dbForProject->createDocument('users', $user);
@@ -875,7 +875,7 @@ App::patch('/v1/users/:userId/password')
             }
         }
 
-        $hooks->trigger('passwordValidator', [$project, $password, $user]);
+        $hooks->trigger('passwordValidator', [$project, $password, &$user]);
 
         $newPassword = Auth::passwordHash($password, Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS);