In prior versions the config file referenced 'admin_password' as we hadn't stabilised the terminology. For compatibility we do accept still lines for 'admin_password' (in fact we give it precedence). However, this is not the same as the admin account password entered at installation, which is read under the POST variable 'cns_admin_password' and never written into the config file.

I am closing this for now, but if I am missing something, re-open. All I can think is you saw this by looking at the code or something, because I don't see how it could manifest in the wild.