diff --git a/addons/base_crypt/crypt.py b/addons/base_crypt/crypt.py
index 9f437ace9fc..0b075c3006e 100644
--- a/addons/base_crypt/crypt.py
+++ b/addons/base_crypt/crypt.py
@@ -220,6 +220,10 @@ class users(osv.osv):
             return False
 
     def check(self, db, uid, passwd):
+        if not passwd:
+            # empty passwords disallowed for obvious security reasons
+            raise security.ExceptionNoTb('AccessDenied')
+
         # Get a chance to hash all passwords in db before using the uid_cache.
         obj = pooler.get_pool(db).get('res.users')
         if not hasattr(obj, "_salt_cache"):