WICKET-1090 I've looked hard to see whether this fix had any negative impact, but couldn't find any. I think this is a pretty obvious bug, but didn't bite too many people because workarounds are available (e.g. directly setting the new password on the component if you look at the case described with WICKET-1090).
wicket/trunk/jdk-1.4/wicket/src/main/java/org/apache/wicket/markup/html/form/FormComponent.java