diff --git a/requests_oauthlib/oauth2_session.py b/requests_oauthlib/oauth2_session.py
index 5c565267..05bc24d5 100644
--- a/requests_oauthlib/oauth2_session.py
+++ b/requests_oauthlib/oauth2_session.py
@@ -197,7 +197,10 @@ def fetch_token(self, token_url, code=None, authorization_response=None,
                 redirect_uri=self.redirect_uri, username=username,
                 password=password, **kwargs)
 
-        auth = auth or requests.auth.HTTPBasicAuth(username, password)
+        if (not auth) and username:
+            if password is None:
+                raise ValueError('Username was supplied, but not password.')
+            auth = requests.auth.HTTPBasicAuth(username, password)
 
         headers = headers or {
             'Accept': 'application/json',