I see the same thing on a test cluster. I presumed it was due to using sssd and kerberos for local user logins.
Here's an example of what gets written to /var/log/secure when root login to cockpit fails.
May 18 11:29:07 br014 unix_chkpwd[26429]: check pass; user unknown
May 18 11:29:07 br014 unix_chkpwd[26430]: check pass; user unknown
May 18 11:29:07 br014 unix_chkpwd[26430]: password check failed for user (root)
May 18 11:29:07 br014 cockpit-session[26427]: pam_unix(cockpit:auth): authentication failure; logname= uid=993 euid=993 tty= ruser= rhost=::ffff:128.182.79.36 user=root
May 18 11:29:07 br014 cockpit-session[26427]: pam_succeed_if(cockpit:auth): requirement "uid >= 1000" not met by user "root"
The uid test is obviously an issue. not sure why check pass seems to always give user unknown errors. tried putting selinux in permissive same issue.