diff --git a/lib/Auth/Basic.php b/lib/Auth/Basic.php
index <HASH>..<HASH> 100644
--- a/lib/Auth/Basic.php
+++ b/lib/Auth/Basic.php
@@ -37,7 +37,13 @@ class Basic extends AbstractAuth {
             return null;
         }
 
-        return explode(':',base64_decode(substr($auth, 6)), 2);
+        $credentials = explode(':',base64_decode(substr($auth, 6)), 2);
+
+        if (2 !== count($credentials)) {
+            return null;
+        }
+
+        return $credentials;
 
     }
`getCredentials` returns null if incomplete.

If the colon is missing (in `user:password`), `getCredentials` will
return an array of one value instead of null whereas this is incorrect.
We then check that the credentials form a pair of two values.