I've no idea if this has already been raised or fixed in a newer release, but I've just upgraded from 4.0.9 to 4.2.3 on Ubuntu (trusty) & found I could no longer login on the webui using the superuser account & the cause seems to be the presence of the anonymous/wildcard (*) account and specifically having it enabled - if its disabled it's not a problem.
Under 4.0.9 I had a couple of user accounts in the ui, one being the anonymous account, but for administrative tasks I would login using the superuser account & I didn't have a separate ui account with admin access. After upgrading though, the superuser would just fail to login. I checked the superuser file and even ran a dpkg-reconfigure but nothing worked. I could however successfully login using one of my other UI accounts that I had previously setup, but that account never had admin access. I eventually started tvheadend with the --noacl option temporarily and created a separate admin account via the UI to get around the problem, but was puzzled why the superuser still failed to work.
So today I installed a clean copy of 4.2.3 in a VM to play with and that worked ok - the superuser could login. I then rolled back the VM and installed 4.0.9 first (which worked) and then upgraded to 4.2.3 and that still worked. It was only when I created an anonymous account on the VM, similar to my main setup that it suddenly refused to let the superuser to login & just continuously presented a login box. Disabling the anonymous account lets me login again with the superuser.
I've now setup a separate admin account in the UI rather than rely on the superuser, but thought I'd post this in case it helps anyone else stuck with the same login issue I had.