thanks for your thoughts and this script. It’s worth to have a deeper look inside.

One improvement I have found by now: you can check if the password is equal to the username on the server-side too.

For this you could insert the following lines of code into ChapAuthenticationImpl.php below the block for checking if the pwd is empty (line 205):
// Check if the plaintext password is the same as the username.
else if ($this->passwordPlainTextTransform($username, $challenge1) == $password)
{
throw new ChapAuthenticationException('Password cannot be equal to the username');
}