[Security] Fix wrong usage in custom authenticator checking if password is invalid#10213