TokenBasedRememberMeServices::onLoginSuccess can throw a NPE when UserDetailsService::loadUserByUsername returns null.

When the Authentication does not contain a password, TokenBasedRememberMeServices::onLoginSuccess performs a call to UserDetailsService::loadUserByUsername (~line 227), to obtain a UserDetails object.

It then proceeds to read UserDetails::getPassword without performing a null check.

In our workflow only a subset of usernames support "remember me", meaning the three possible responses from UserDetailsService::loadUserByUsername are:

1. When the username exists and supports remember me --> an instance of UserDetails
2. When the username exists and does NOT support remember me --> a null response
3. When the username does NOT exist --> a UsernameNotFoundException

Because TokenBasedRememberMeServices::onLoginSuccess is designed to simply return without generating a cookie when the password cannot be obtained, this issue can be fixed by simply changing line 228

from:
password = user.getPassword();

to:
password = (user == null) ? password : user.getPassword();

Start at TokenBasedRememberMeServices::onLoginSuccess around line 227 and inspect the path where Authentication has no password and loadUserByUsername returns null. Done means this case returns without generating a cookie or throwing a NullPointerException, while existing UserDetails and UsernameNotFoundException behavior remains unchanged.