When you send the form "change password" with incorrect data, the password inputs are pre-filled with spaces.
How to reproduce it:
- configure LDAP authentication module
- Set up password policy in the data store
- force a password change for login
- Enter the right Old Password but a wrong new password (for example, one that doesn't fulfill policy)
As you send incorrect data, you will have the same form with an error message.
It will also have the passwords inputs pre-filled with values that seem to be your previous entry. Actually, it's filled with spaces.
Those inputs should be empty or pre-filled with the right values.