Currently JIRA seems to allow an administrator to create a User with a blank password.
However, that user is not able to log in with the blank password.
Furthermore, if you attempt to change the password on an existing user, there is validation that does not allow a blank password to be entered.

This leads me to believe that the Add User page should also validate against blank passwords