Hi @harry.hause,
Thanks for the update.
The “Password change required” error message happens when a user logs in with the wrong credentials after a password hash import and before a successful login.
(Reference: Password Change Required After Password Hash Import)
In this case, there’s an inherent issue with the imported users’ password hashes. Either the user submitted the wrong credentials, or the password hash import is incorrect.
I would suggest investigating this further to reduce the number of affected users from logging in.
As for checking for the user_metadata before validating the password, this won’t be possible since the post-login action will only execute after a user submits the correct credentials.