Where does Webmin stores its passwords?
Both the other answers are wrong, at least if the question is about the users of webmin itself. Default (Webmin 1.710) is to allow only webmin users to log in to webmin, with root as the initial only existing user, and shadow authentication for root only.
The webmin user database is stored in /etc/webmin/miniserv.users with traditional unix style contents.