--- a/plugins/Yubikey.php	Thu Feb 26 16:33:06 2009 -0500
+++ b/plugins/Yubikey.php	Sun Mar 01 20:41:17 2009 -0500
@@ -110,6 +110,7 @@
         err_nothing_provided: 'You did not provide a Yubikey OTP or a username. One of these is required for login to work.',
         err_must_have_otp: 'Please provide a Yubikey OTP to log in to this account.',
         err_must_have_username: 'Please provide your username.',
+        err_must_have_password: 'Please enter your password in addition to your username and Yubikey.',
         err_key_not_authorized: 'This Yubikey is not authorized on this site.',
         err_otp_invalid_chars: '%this.yubiauth_err_invalid_otp%',
         err_missing_api_key: 'Your OTP could not be validated because no Yubico API key is registered on this site.',

--- a/plugins/yubikey/auth.php	Thu Feb 26 16:33:06 2009 -0500
+++ b/plugins/yubikey/auth.php	Sun Mar 01 20:41:17 2009 -0500
@@ -165,6 +165,13 @@
   // Do we need to have the password validated?
   if ( $do_validate_pass )
   {
+    if ( empty($userdata['password']) )
+    {
+      return array(
+          'mode' => 'error',
+          'error' => 'yubiauth_err_must_have_password'
+        );
+    }
     // Yes; return and let the login API continue
     return null;
   }