When authenticating via pam_winbind with cached_login and try_first_pass options enabled, submitting an empty password results in the user being granted access, instead of being rejected as expected.

This was first discovered via KDE Plasma's screen locker (kscreenlocker) on Wayland, but was confirmed to be independent of KDE/Wayland using wbinfo --pam-logon directly (see below).

Important finding: This machine is NOT joined to a functional Active Directory domain. wbinfo -t fails with WBC_ERR_WINBIND_NOT_AVAILABLE, and net ads testjoin fails with "Access Denied" and cannot open secrets.tdb. "WORKGROUP" is just the default, non-functional domain name — there is no valid domain trust configured. Despite this, an empty password is still accepted.


Direct reproduction (isolated from KDE):

```
$ wbinfo --pam-logon 'mathieu%'
plaintext password authentication succeeded
```

(Empty string after %, i.e. no password.)

```
$ wbinfo -t
checking the trust secret for domain WORKGROUP via RPC calls failed
failed to call wbcCheckTrustCredentials: WBC_ERR_WINBIND_NOT_AVAILABLE
Could not check secret

$ net ads testjoin
Failed to open /var/lib/samba/private/secrets.tdb
Join to domain is not valid: {Access Denied} A process has requested access to an object but has not been granted those access rights.
```


A wrong (non-empty) password is correctly rejected. Only an empty password triggers the bypass, even with no working domain join behind it.


PAM configuration (/etc/pam.d/common-auth):

auth    [success=2 default=ignore]      pam_unix.so nullok
auth    [success=1 default=ignore]      pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so


Observed behavior via kscreenlocker (journalctl logs):

Failed attempt with wrong password (correct behavior):

pam_unix(kde:auth): authentication failure; logname=mathieu uid=1000 euid=1000 tty= ruser= rhost=  user=mathieu
pam_winbind(kde:auth): getting password (0x00000388)
pam_winbind(kde:auth): pam_get_item returned a password
pam_winbind(kde:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_AUTH_ERR (7), NTSTATUS: NT_STATUS_WRONG_PASSWORD
pam_winbind(kde:auth): user 'mathieu' denied access (incorrect password or invalid membership)

Attempt with empty password (bug — access granted):

pam_winbind(kde:auth): getting password (0x00000388)
pam_winbind(kde:auth): pam_get_item returned a password
pam_winbind(kde:auth): user 'mathieu' granted access


Steps to Reproduce:

- Via kscreenlocker (KDE Plasma):

1. Log into the session normally via SDDM
2. Lock the screen (manually, or by suspending/closing the lid)
3. On the kscreenlocker unlock prompt, leave the password field empty
4. Press Enter
5. Session unlocks without any valid authentication

- Via wbinfo directly (isolated from KDE, easier to reproduce):

1. Run: wbinfo --pam-logon 'username%' (replace username with a valid local/domain user, and leave the password empty after %)
2. Observe output: "plaintext password authentication succeeded"

Actual results:
Access is granted despite the empty password.

Expected results:
Authentication should fail on an empty password, the same way it fails on any other incorrect password.


Environment:

- Samba version: 4.22.10-Debian-4.22.10+dfsg-0+deb13u2
- OS: Debian trixie (Linux, x86_64)
- Desktop environment: KDE Plasma 6.3.6, Wayland (kscreenlocker) — used to originally trigger the issue, confirmed independent of KDE via wbinfo
- No functional AD domain join (see net ads testjoin / wbinfo -t output above); "WORKGROUP" is the default placeholder domain


Note: this PAM configuration was not manually customized,  it appears to be the default resulting from installing the winbind package on Debian 13 (trixie) via pam-auth-update. I never manually ran pam-auth-update or edited PAM files myself.