In org.ametys.runtime.plugins.core.authentication.FormBasedCredentialsProvider around the line 143, there is a substring that can lead to a IndexOutOfBoundsException.
In my case, it happens because request.getRequestURI() returns the empty String "", because the current servlet is in the default (root) context.

This case must be handled correctly to prevent the AuthenticateAction to fail.