When QNetworkAccessManager::authenticationRequired() is emitted and only a password is entered then the password will not be sent to the server. In addition, if a previous request for the same URL was loaded with a non-empty user (with an optional password) then that user and password combination will be used instead. Looks like Qt picks this up from the authentication cache at some point.

Attaching an autotest (along with a server-side auth.php file) that shows the problem, shouldn't be too hard for you guys to adapt this into your internal QNetworkReply test.