This bug is a security issue first reported for 4.0.4 as bug
#9022 and has yet to be fixed. The security flaw remains.

According to the PHP documentation, if a user is authenticated
using and external HTTP basic authentification mechanism such
as the various mechanisms available under Apache (I tested
file-based and LDAP-based authentification), the PHP_AUTH_PW
and PHP_AUTH_USER variables SHOULD NOT BE SET. This is the
correct and desired behavior as it prevents malicious users
from capturing this information in environments where they
are permitted to host PHP scripts that authenticate off an
external resource.

However, the password information is always returned by
PHP - exposing the user password. Demonstrating the exploit
is very simple:

Make a directory with the following script in it:

<?php phpinfo(); ?>

Then create an .htaccess file like:

AuthType Basic
AuthName "This is a test"
AuthUserfile .htpasswd
Require valid-user

... and make the .htpasswd file with a username and password.

When you go to the phpinfo page, note that the username
and password are contained on the page (as PHP_AUTH_USER
and PHP_AUTH_PW respectively).