Index: lib/libpam/modules/pam_exec/pam_exec.c
===================================================================
--- lib/libpam/modules/pam_exec/pam_exec.c
+++ lib/libpam/modules/pam_exec/pam_exec.c
@@ -261,13 +261,13 @@
 			/* don't prompt, only expose existing token */
 			rc = pam_get_item(pamh, PAM_AUTHTOK, &item);
 
-			if (item != NULL) {
-				authtok = item;
-			} else {
+			if (item == NULL && rc == PAM_SUCCESS) {
 				openpam_log(PAM_LOG_ERROR, 
 				    "%s: pam_get_authtok(): %s",
 				    func, "existing token not available");
 				OUT(PAM_SYSTEM_ERR);
+			} else {
+				authtok = item;
 			}
 		} else {
 			rc = pam_get_authtok(pamh, PAM_AUTHTOK, &authtok, NULL);