The api/v1/login returns a valida token/user_id without a password being passed

Description:

Calling the api api/v1/login in a LDAP enabled environment without pass a password, returns a valid token/user_id for the informed username.

Steps to reproduce:

Using any API Rest client, call the api/v1/login with the following payload

{ 
    "username":"<inform_any_username_here>", 
    "ldapPass":"",
    "ldap":true,
    "ldapOptions":{}
}

Expected behavior:

This API call should return a 401 Unauthorized code.

Actual behavior:

It returns a valid token/user_id which allows me to impersonate this user, and call another api, like chat.postMessage with the headers X-Auth-Token and X-User-ID.

Server Setup Information:

• Version of Rocket.Chat Server: 3.5.0
• Operating System: Centos 7 x86_64
• Deployment Method: AWS EC2
• Number of Running Instances: 1 EC2 instances
• DB Replicaset Oplog: N/A
• NodeJS Version: The version required by de Rocket.Chat 3.5.0
• MongoDB Version: 4.2

Client Setup Information

• Desktop App or Browser Version: N/A
• Operating System: N/A

Additional context

N/A

Relevant logs:

N/A