Authen::Smb is written in C. It could be a problem with CGI, but that would be most unexpected (and easily verifiable by printing $password).