change password

I have created a "change passowrd page" but when this is applied the 2nd password confirmation makes no difference.
The password is changed to whatever the first new password box states - the confirmation can even be left blank.
Are I missing something?