sshd accepts any password, for any account

I have a newly installed OSX 10.9.5 iMac system on which I enabled remote logins (ssh) in Sys Prefs. That works, but with a weird twist: users ssh’ing in can type in any password (or even a return) at the Password: prompt and will still get logged in! What's even worse is that any other account (even a privileged username) can be specified on the ssh command line and the login happens into that account!

There's not much in the console log.

Here's what's generated when I enable remote logins in Sys Prefs:

8:32:36 PM com.apple.preferences.sharing.remoteservice: remote view marshal proxy failed to forward event to remote due to Error Domain

8:32:36 PM com.apple.preferences.sharing.remoteservice: assertion failed: 13F34: liblaunch.dylib + 25164

8:32:36 PM com.apple.preferences.sharing.remoteservice: assertion failed: 13F34: liblaunch.dylib + 25164

8:32:36 PM com.apple.preferences.sharing.remoteservice: Bogus event received by listener connection:<error: 0x7fff7750db50>

8:32:36 PM com.apple.preferences.sharing.remoteservice: nsc_smb XPC: handler_event error : < Connection invalid >

Here's what's generated (for any account) when I successfully ssh into the machine, hitting return at the Password: prompt:

8:33:55 PM sshd: transini [priv]: USER_PROCESS: 8211 ttys002

8:33:55 PM sshd: transini [priv]: DEAD_PROCESS: 8211 ttys002

What could be causing this?