diff --git a/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs b/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs
index cf69fda91a..1f2d679df5 100644
--- a/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs
+++ b/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs
@@ -122,6 +122,13 @@ public class AbpResourceOwnerPasswordValidator : IResourceOwnerPasswordValidator
                 else if (result.IsNotAllowed)
                 {
                     Logger.LogInformation("Authentication failed for username: {username}, reason: not allowed", context.UserName);
+
+                    if (user.ShouldChangePasswordOnNextLogin)
+                    {
+                        context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, nameof(user.ShouldChangePasswordOnNextLogin));
+                        return;
+                    }
+
                     errorDescription = Localizer["LoginIsNotAllowed"];
                 }
                 else
diff --git a/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.Password.cs b/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.Password.cs
index 6406c935c7..6ffe3acec3 100644
--- a/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.Password.cs
+++ b/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.Password.cs
@@ -101,6 +101,16 @@ public partial class TokenController
                     else if (result.IsNotAllowed)
                     {
                         Logger.LogInformation("Authentication failed for username: {username}, reason: not allowed", request.Username);
+
+                        if (user.ShouldChangePasswordOnNextLogin)
+                        {
+                            return Forbid(
+                                new AuthenticationProperties(items: new Dictionary<string, string> {
+                                    [OpenIddictServerAspNetCoreConstants.Properties.Error] = OpenIddictConstants.Errors.InvalidGrant,
+                                    [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = nameof(user.ShouldChangePasswordOnNextLogin)
+                                }), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
+                        }
+
                         errorDescription = "You are not allowed to login! Your account is inactive or needs to confirm your email/phone number.";
                     }
                     else
@@ -197,8 +207,7 @@ public partial class TokenController
                 items: new Dictionary<string, string>
                 {
                     [OpenIddictServerAspNetCoreConstants.Properties.Error] = OpenIddictConstants.Errors.InvalidGrant,
-                    [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] =
-                        nameof(SignInResult.RequiresTwoFactor),
+                    [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = nameof(SignInResult.RequiresTwoFactor)
                 },
                 parameters: new Dictionary<string, object>
                 {