untrusted comment: verify with openbsd-65-base.pub
RWSZaRmt1LEQTxhuq61KtzTgYyBsyYHLANPUZH+GZ/shrSkjKacTB8Auay1AqefAGbdj+5+VtK6E7VciRXvcQzNs6aGDiOqQwAU=

OpenBSD 6.5 errata 022, December 3, 2019:

xenodm uses the libc authentication layer incorrectly.

Apply by doing:
    signify -Vep /etc/signify/openbsd-65-base.pub -x 022_xenodm.patch.sig \
        -m - | (cd /usr/xenocara && patch -p0)

And then compile and rebuild xenodm
    cd /usr/xenocara/app/xenodm
    make -f Makefile.bsd-wrapper obj
    make -f Makefile.bsd-wrapper build

Index: app/xenodm/greeter/verify.c
===================================================================
RCS file: /cvs/xenocara/app/xenodm/greeter/verify.c,v
diff -u -p -u -r1.9 verify.c
--- app/xenodm/greeter/verify.c	11 Jul 2018 16:20:20 -0000	1.9
+++ app/xenodm/greeter/verify.c	3 Dec 2019 03:44:50 -0000
@@ -136,7 +136,7 @@ Verify (struct display *d, struct greet_
 	explicit_bzero(greet->password, passwd_len);
 	/* Build path of the auth script and call it */
 	snprintf(path, sizeof(path), _PATH_AUTHPROG "%s", style);
-	auth_call(as, path, style, "-s", "response", greet->name,
+	auth_call(as, path, style, "-s", "response", "--", greet->name,
 		  lc->lc_class, (void *)NULL);
 	authok = auth_getstate(as);