We use the wrong construct to get the user password expiration value in .../login/index.php. We use a pre-multi authentication construct that always returns 0 (the integer value for the empty string), so the password expiration check is incorrect.

The attached patches (for 1.8 and 1.9) fix this issue.

Saludos. Iñaki.