diff --git a/structr-rest/src/main/java/org/structr/rest/servlet/ConfigServlet.java b/structr-rest/src/main/java/org/structr/rest/servlet/ConfigServlet.java
index <HASH>..<HASH> 100644
--- a/structr-rest/src/main/java/org/structr/rest/servlet/ConfigServlet.java
+++ b/structr-rest/src/main/java/org/structr/rest/servlet/ConfigServlet.java
@@ -27,6 +27,7 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
+import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.structr.api.config.Setting;
@@ -189,7 +190,8 @@ public class ConfigServlet extends AbstractServletBase {
 			switch (action) {
 
 				case "login":
-					if (Settings.SuperUserPassword.getValue().equals(request.getParameter("password"))) {
+					
+					if (StringUtils.isNoneBlank(Settings.SuperUserPassword.getValue(), request.getParameter("password")) && Settings.SuperUserPassword.getValue().equals(request.getParameter("password"))) {
 						authenticateSession(request);
 					}
 					break;
Fix: Don't allow empty passwords for configuration backend.