Strapi /auth/local api throws 500 error for wrong password or email not confirmed

I figured it out.

Check the version of strapi/user-permissions package - make sure that it is 4.16.2

This worked for me.