The security app checks for empty passwords and prevents them when editing users, but not when creating a new user. In this way users can be created without a password.

Combined with the other bug I just reported (MGNLEE-594), this means that users created in this way can then log in with no password.

Please add the empty password check also on user creation.