Prevent it from exploding if you try to log in with a user who has no password in the database.

flask_security/core.py

@@ -112,6 +112,7 @@ _default_messages = {
     'EMAIL_NOT_PROVIDED': ('Email not provided', 'error'),
     'INVALID_EMAIL_ADDRESS': ('Invalid email address', 'error'),
     'PASSWORD_NOT_PROVIDED': ('Password not provided', 'error'),
+    'PASSWORD_NOT_SET': ('No password is set for this user', 'error'),
     'PASSWORD_INVALID_LENGTH': ('Password must be at least 6 characters', 'error'),
     'USER_DOES_NOT_EXIST': ('Specified user does not exist', 'error'),
     'INVALID_PASSWORD': ('Invalid password', 'error'),

flask_security/forms.py

@@ -225,6 +225,9 @@ class LoginForm(Form, NextFormMixin):
         if self.user is None:
             self.email.errors.append(get_message('USER_DOES_NOT_EXIST')[0])
             return False
+        if not self.user.password:
+            self.password.errors.append(get_message('PASSWORD_NOT_SET')[0])
+            return False
         if not verify_and_update_password(self.password.data, self.user):
             self.password.errors.append(get_message('INVALID_PASSWORD')[0])
             return False