Why would HMAC be inappropriate in this case (of storing user credentials)? Is there a vulnerability?

HMAC(key, password) instead of hash(password) or hash(salt+password)