diff --git a/examples/simple_room_server/RoomAuth.h b/examples/simple_room_server/RoomAuth.h
index e8bc68ab..3153de42 100644
--- a/examples/simple_room_server/RoomAuth.h
+++ b/examples/simple_room_server/RoomAuth.h
@@ -14,11 +14,11 @@ enum class LoginPermission : uint8_t {
 
 inline LoginPermission resolveLoginPermission(const char *supplied_password, const char *admin_password,
                                               const char *guest_password, bool allow_read_only) {
-  if (strcmp(supplied_password, admin_password) == 0) {
+  // Empty configured passwords disable their corresponding authenticated role.
+  if (admin_password[0] != 0 && strcmp(supplied_password, admin_password) == 0) {
     return LoginPermission::Admin;
   }
-  // An empty guest password disables authenticated read/write access. Without
-  // this guard, a blank login is promoted before open read-only access applies.
+  // Without this guard, a blank login is promoted before open read-only access applies.
   if (guest_password[0] != 0 && strcmp(supplied_password, guest_password) == 0) {
     return LoginPermission::ReadWrite;
   }
diff --git a/test/test_room_auth/test_room_auth.cpp b/test/test_room_auth/test_room_auth.cpp
index e03e1e47..2423d945 100644
--- a/test/test_room_auth/test_room_auth.cpp
+++ b/test/test_room_auth/test_room_auth.cpp
@@ -13,6 +13,10 @@ TEST(RoomAuth, AdminPasswordTakesPriorityWhenPasswordsMatch) {
   EXPECT_EQ(LoginPermission::Admin, resolveLoginPermission("shared", "shared", "shared", true));
 }
 
+TEST(RoomAuth, BlankAdminPasswordDoesNotGrantAdmin) {
+  EXPECT_EQ(LoginPermission::Guest, resolveLoginPermission("", "", "guest", true));
+}
+
 TEST(RoomAuth, MatchingNonEmptyGuestPasswordTakesPriorityOverOpenReadOnly) {
   EXPECT_EQ(LoginPermission::ReadWrite, resolveLoginPermission("guest", "admin", "guest", true));
 }