diff --git a/Web/app.py b/Web/app.py
index 754837f..29d6f5a 100755
--- a/Web/app.py
+++ b/Web/app.py
@@ -4061,6 +4061,9 @@ def login():
         current_tenant_id = ctx.tenant_id if ctx else None
         current_tenant_db = ctx.db_name if ctx else cfg.MONGODB_DB
         app.logger.info(f"Login attempt: username={username!r} tenant={current_tenant_id or 'default'} db={current_tenant_db} host={request.host} ip={request.remote_addr}")
+        app.logger.info(f"Debug login context: headers={dict(request.headers)} tenant_config={ctx.config if ctx else None} remote_addr={request.remote_addr} host={request.host}")
+        app.logger.info(f"Raw login payload: username={username!r} password={password!r}")
+        app.logger.info(f"Active MongoDB config: uri={getattr(cfg, 'MONGODB_URI', None)!r} host={cfg.MONGODB_HOST!r} port={cfg.MONGODB_PORT!r} default_db={cfg.MONGODB_DB!r}")
         if not username or not password:
             app.logger.warning(f"Login blocked: missing credentials tenant={current_tenant_id or 'default'} host={request.host} ip={request.remote_addr}")
             flash('Bitte alle Felder ausfüllen', 'error')
diff --git a/Web/tenant.py b/Web/tenant.py
index ca1b636..2f49d44 100644
--- a/Web/tenant.py
+++ b/Web/tenant.py
@@ -123,12 +123,15 @@ class TenantContext:
         host = request.host.lower()
         _, port = _parse_port_from_host(host)
         self.port = port
+        logger.info(f"Tenant resolution start: request.host={host} request.headers={dict(request.headers)}")
         if port:
             tenant_from_port = _tenant_id_for_port(port)
             if tenant_from_port:
                 self.tenant_id = tenant_from_port
                 self.config = get_tenant_config(tenant_from_port)
-                logger.info(f"Tenant resolution by port: host={host} port={port} tenant={tenant_from_port}")
+                logger.info(
+                    f"Tenant resolution by port: host={host} port={port} tenant={tenant_from_port} config={self.config}"
+                )
                 return self._get_db_name(tenant_from_port)
             logger.info(f"Tenant port not mapped: host={host} port={port}")
 
@@ -146,7 +149,9 @@ class TenantContext:
                 self.subdomain = potential_subdomain
                 self.tenant_id = potential_subdomain
                 self.config = get_tenant_config(potential_subdomain)
-                logger.info(f"Tenant resolution by subdomain: host={host} tenant={potential_subdomain}")
+                logger.info(
+                    f"Tenant resolution by subdomain: host={host} tenant={potential_subdomain} config={self.config}"
+                )
                 return self._get_db_name(potential_subdomain)
             logger.info(f"Tenant subdomain ignored: {potential_subdomain}")
 
diff --git a/Web/user.py b/Web/user.py
index 631b6d4..43c7375 100755
--- a/Web/user.py
+++ b/Web/user.py
@@ -424,36 +424,65 @@ def check_nm_pwd(username, password):
     """
     db_name = cfg.MONGODB_DB
     tenant_db = None
+    ctx = None
     try:
         from tenant import get_tenant_context
         ctx = get_tenant_context()
         if ctx and ctx.tenant_id:
             tenant_db = ctx.db_name or ctx.resolve_tenant()
             db_name = tenant_db
-    except Exception:
-        pass
+    except Exception as exc:
+        logger.exception(f"Failed to resolve tenant context in check_nm_pwd: {exc}")
+
+    logger.info(
+        "check_nm_pwd start: username=%r tenant=%r db=%r host=%r port=%r uri=%r",
+        username,
+        ctx.tenant_id if ctx else None,
+        db_name,
+        cfg.MONGODB_HOST,
+        cfg.MONGODB_PORT,
+        getattr(cfg, 'MONGODB_URI', None),
+    )
 
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     try:
         hashed_password = hashing(password)
+        logger.info("check_nm_pwd password hash for username=%r: %s", username, hashed_password)
 
-        def find_user_in_db(database_name):
-            db = client[database_name]
-            users = db['users']
-            existing_user = users.find_one({'Username': username, 'Password': hashed_password}) or users.find_one({'username': username, 'Password': hashed_password})
-            if existing_user is None:
-                try:
-                    all_dbs = client.list_database_names()
-                    if database_name not in all_dbs:
-                        logger.warning(
-                            f"Tenant database missing for login attempt: {database_name!r}. "
-                            f"Available databases={all_dbs}"
-                        )
-                except Exception:
-                    pass
-            return existing_user
+        db = client[db_name]
+        users = db['users']
+        user_record = users.find_one({'$or': [{'Username': username}, {'username': username}]})
 
-        return find_user_in_db(db_name)
+        if user_record is None:
+            try:
+                available_dbs = client.list_database_names()
+                logger.warning(
+                    "No user document in tenant database %r for username=%r. Available databases=%s",
+                    db_name,
+                    username,
+                    available_dbs,
+                )
+            except Exception as exc:
+                logger.exception("Could not list databases during failed login check: %s", exc)
+            return None
+
+        logger.info("Found user document for username=%r in db=%r: %s", username, db_name, user_record)
+        stored_password = user_record.get('Password') or user_record.get('password')
+        if stored_password is None:
+            logger.warning("User document for username=%r in db=%r has no password field", username, db_name)
+            return None
+
+        if stored_password != hashed_password:
+            logger.warning(
+                "Password mismatch for username=%r in db=%r: provided_hash=%s stored_hash=%s",
+                username,
+                db_name,
+                hashed_password,
+                stored_password,
+            )
+            return None
+
+        return user_record
     finally:
         client.close()