The WWW-Authenticate header value that arrives from the server can be either "NTLM" or "NTLM base64-challenge-string".
There is a single space character between the NTLM and base64-challenge-string.
Similarly as there is a single space in Basic or Digest WWW-Authenticate header.
The problem is that there is a wrong string offset value in HTTPCredentials::isNTLMCredentials(const std::string& header).
return icompare(header, 0, 4, "NTLM") == 0 && (header.size() > 5 ? Poco::Ascii::isSpace(header[5]) : true);
should be
return icompare(header, 0, 4, "NTLM") == 0 && (header.size() > 4 ? Poco::Ascii::isSpace(header[4]) : true);

The HTTPCredentials::isBasicCredentials(const std::string& header) and HTTPCredentials::isDigestCredentials(const std::string& header) are good. Only HTTPCredentials::isNTLMCredentials(const std::string& header) has wrong string offset.