@davidmixer on WordPress.org
Created ticket #24099 on Core Trac:It's possible to create a user with a password that will not work on login