diff --git a/flask_security/core.py b/flask_security/core.py
index aa8be7a..9a4c671 100644
--- a/flask_security/core.py
+++ b/flask_security/core.py
@@ -112,6 +112,7 @@ _default_messages = {
     'EMAIL_NOT_PROVIDED': ('Email not provided', 'error'),
     'INVALID_EMAIL_ADDRESS': ('Invalid email address', 'error'),
     'PASSWORD_NOT_PROVIDED': ('Password not provided', 'error'),
+    'PASSWORD_NOT_SET': ('No password is set for this user', 'error'),
     'PASSWORD_INVALID_LENGTH': ('Password must be at least 6 characters', 'error'),
     'USER_DOES_NOT_EXIST': ('Specified user does not exist', 'error'),
     'INVALID_PASSWORD': ('Invalid password', 'error'),
diff --git a/flask_security/forms.py b/flask_security/forms.py
index e43ffd0..0b68717 100644
--- a/flask_security/forms.py
+++ b/flask_security/forms.py
@@ -225,6 +225,9 @@ class LoginForm(Form, NextFormMixin):
         if self.user is None:
             self.email.errors.append(get_message('USER_DOES_NOT_EXIST')[0])
             return False
+        if not self.user.password:
+            self.password.errors.append(get_message('PASSWORD_NOT_SET')[0])
+            return False
         if not verify_and_update_password(self.password.data, self.user):
             self.password.errors.append(get_message('INVALID_PASSWORD')[0])
             return False