I have the same issue. If a password contains one of the symbols less-than, greater-than, or ampersand, the web services WSDL logon request fails with "Unknown user or password".
It definitely looks like a bug in SageCRM SOAP API. Does anyone have a fix or workaround?
24 Sep 2014