This is not a libvirt bug. This is caused by a flaw in particular QEMU version you are using, which silently disables auth when the password is set to "". This bug was introduced in QEMU in this bogus commit
commit 52c18be9e99dabe295321153fda7fce9f76647ac Author: Zachary Amsden <email address hidden> Date: Thu Jul 30 00:15:01 2009 -1000
When using stdio monitor and VNC display, one can set or clear a VNC password; this should set or turn off VNC authentication as well.
This is not a libvirt bug. This is caused by a flaw in particular QEMU version you are using, which silently disables auth when the password is set to "". This bug was introduced in QEMU in this bogus commit
commit 52c18be9e99dabe 295321153fda7fc e9f76647ac
Author: Zachary Amsden <email address hidden>
Date: Thu Jul 30 00:15:01 2009 -1000
When using stdio monitor and VNC display, one can set or clear a VNC password; this should set or turn off VNC authentication as well.