untrusted comment: verify with openbsd-66-base.pub
RWSvK/c+cFe24JIpl+5iZNAWl4r0NgVNEP9c1mf5Umy0hisfUDk6R5kyJNCluLvwFYGHjUYAZakKg1uCQvt8jp+4XKykNwumlQQ=

OpenBSD 6.6 errata 011, December 3, 2019:

xenodm uses the libc authentication layer incorrectly.

Apply by doing:
    signify -Vep /etc/signify/openbsd-66-base.pub -x 011_xenodm.patch.sig \
        -m - | (cd /usr/xenocara && patch -p0)

And then compile and rebuild xenodm
    cd /usr/xenocara/app/xenodm
    make -f Makefile.bsd-wrapper obj
    make -f Makefile.bsd-wrapper build

Index: app/xenodm/greeter/verify.c
===================================================================
RCS file: /cvs/xenocara/app/xenodm/greeter/verify.c,v
diff -u -p -u -r1.9 verify.c
--- app/xenodm/greeter/verify.c	11 Jul 2018 16:20:20 -0000	1.9
+++ app/xenodm/greeter/verify.c	3 Dec 2019 03:45:24 -0000
@@ -136,7 +136,7 @@ Verify (struct display *d, struct greet_
 	explicit_bzero(greet->password, passwd_len);
 	/* Build path of the auth script and call it */
 	snprintf(path, sizeof(path), _PATH_AUTHPROG "%s", style);
-	auth_call(as, path, style, "-s", "response", greet->name,
+	auth_call(as, path, style, "-s", "response", "--", greet->name,
 		  lc->lc_class, (void *)NULL);
 	authok = auth_getstate(as);