We wanted to follow up with anyone else with this issue.  

We found the cause: when a user logs in, it automatically checks for any plaintext passwords in the database and encrypts them.  However, it wasn't coded to accept an empty 0-byte string.  This can happen if you import a user from another system or create a user account in a separate table and don't set the password.

David's temporary fix of commenting out the "Password cannot be blank" will work, and we've fixed this for the next version.

Logging in without specifying a password is impossible, so it's completely secure in every case.  

We often have multiple levels of safety checking, and in this case, we had one too many for the situation.

Thanks all!

That's done the trick for me too.

Dave and/or Tim. Would you be able to chip in and let us know if this has any other repursions, security wise?

Also, any idea why it's an issue on some sites and not all? I've not done an extensive test, and it could be a coincidence, but the site with the error is the only site I have running with 3.75.

EDIT. I updated from 3.74 to 3.75 on the 27 December, and we didn't have any issues until today. It was working fine around 8-9pm (GMT) yesterday. Error first noticed around 7am today.

i cant remember exactly which file it was, LIB folder i believe, i found the line that was giving me the error, i commented it out, (it looks to be a secondary check thats failing for some reason), so commenting it out has stopped the error for me, 

i just searched the error specifically in my project folder , it came up with the Lib file, and commented it out. 

i have no idea if thats the right thing to do, but it works

UPDATE: the file was LIB\Password.php

line 44 : // $plaintext === '' => throw new InvalidArgumentException('Password cannot be blank'),

DId you ever get to the bottom of this? I have the same issue. I already force https, so I can't solve it with that!

I've looked at everything I can think of. I've tried php versions, removed cmsb plugins, removed third party code like Google Tag Manager and TrustPilot, reverted to the orginal factory settings for the websiteMembership plugin, different browsers.

Looking at the logs, it looks like everything is being passed to the server correctly. 

Any further insight would be hugely appreciated!

but for now forcing https seems to have ”fixed” the issue 

We are still investigating this issue and it is in our queue. I believe the error message you posted might be totally unrelated, but is something we will check out as well. 

im also reciving this error in yellow:

Unexpected output was sent by a program library or plugin.

Output was "

" (7 chars)

Developers: Check plugins and library files for accidentally added whitespace or other characters.

don't know if its related

Okay, can you see if the error gets logged to the error log and send me that at dave@interactivetools.com?

Under Admin > Backup, you could back up the error log table and send it to me. 

There might be some clues in there as to what is going on on the server.

Can you fill out a second level support request here: https://interactivetools.com/support/request/

I'll take a look and see if it's caused by anything related to CMS.  If you can, also provide steps to reproduce.

Thanks!

ive recently moved our crm to a new server. php 8.3.6. not everytime , but most of the time when i try to log in to the cmsb i get the "Error: Password cannot be blank"  and we cant login, would anybody have any ideas? 

i have had this error: Password cannot be blank in /home/*******/admin/plugins/websiteMembership/websiteMembership.php on line 155 which is: loginCookie_set($userRecord['username'], getPasswordDigest(@$_REQUEST['password']));

any help would be useful. thanks in advance