Issue 

After updating from an earlier version of Pega Platform™ to 26.1, users entering values into the OOB password fields pyPwdNew and pyPwdConfirmText on a Change Password form find that the entered values are wiped out when they tab out of the field or move focus elsewhere. Even when values visually remain in the browser, they are not available on server-side during flow action processing, causing the password change to fail with a "A password must be supplied" validation message. 

Symptoms and Impact

Users cannot keep input in password update form fields. Values may clear when tabbing or moving focus, or be silently discarded on submission, so the password is never updated. 

Symptoms include: 

• The Change Password form shows "A password must be supplied" even though both password fields were filled in. 
• Tracer shows @baseclass.ReloadCell running with param.updateDOM set to true when a password field loses focus. 
• Replacing the password controls with plain text inputs keeps the values, but the input is no longer masked.  

Steps to reproduce 

1. Open the application and click Change Password.  
2. In the New Password field enter your new password.  
3. In the Confirm Password field re-enter your new password. 
4. Press Tab to move to the Submit button. Result: The entered values are cleared.   
   • Or: 
5. Click Submit button.  Result: The server-side validation fails with the message "A password must be supplied" even though values were entered. 

Root Cause 

This issue is caused by two separate factors that surface sequentially: 

Factor 1 — Change-to-Post value action on password fields (triggers the on-blur wipe) 

Both pyPwdNew and pyPwdConfirmText properties have a Change-to-Post value action configured on the cell. On blur, this triggers @baseclass.ReloadCell with param.updateDOM = true, causing the field to re-render. Because password-type properties are never sent back to the browser for security reasons, the field re-renders as empty. 

Factor 2 — Infinity ‘26.1 security hardening restricting system page property updates  

Pega Platform 26.1.0 introduced a security hardening enhancement that restricts user-submitted property updates targeting system pages such as OperatorID, unless those properties are explicitly included in an allowlist.  

The platform-level default allowlist does not include OperatorID.pyPwdNew or OperatorID.pyPwdConfirmText. As a result, even though the browser correctly submits those values at form submission time, the server rejects them before they reach the OperatorID clipboard page during flow action processing. 

This is the primary reason the password validation fails with a required-field error even when the user has entered valid values. 

Solution 

The following steps must be applied in sequence.  

• Steps 1 and 4 address the UI-layer configuration.  
• Steps 2–3 address the platform security configuration change introduced in 26.1.0. 

Step 1 — Remove the Change-to-Post value action from both password fields 

1. Open the section containing pyPwdNew and pyPwdConfirmText in Dev Studio. To locate them: 
   1. In Dev Studio, go to Records Explorer. 
   2. Navigate to User Interface → Section. 
   3. Filter by class Data-Admin-Operator-ID. 
   4. Look for a section containing pyPwdNew or pyPwdConfirmText in its field list. 
2. Select the cell for pyPwdNew, go to Cell Properties → Actions tab, and delete the Change-to-Post value action set. 
3. Repeat for pyPwdConfirmText. 
4. Save the section. 
5. Test: enter a value, tab out, and confirm it no longer disappears. 

This resolves the on-blur wipe. Proceed to Step 2 to resolve the server-side rejection. 

Step 2 — Create the Dynamic System Setting to allowlist the password properties 

Create a Dynamic System Setting (DSS) with the following attributes: 

• Owning Ruleset: Pega-Engine 
• Setting Purpose: prconfig/security/allowedSystemPagePropsUpdateList/default 
• Value: pxRequestor.pyFileUpload,OperatorID.pyPwdNew,OperatorID.pyPwdConfirmText 

Important: If the DSS prconfig/security/allowedSystemPagePropsUpdateList/default already exists in the environment, do not replace its value. Instead, append ,OperatorID.pyPwdNew,OperatorID.pyPwdConfirmText to the existing comma-separated list to preserve any other allowlisted properties already configured. 

Step 3 — Restart the application server 

The Dynamic System Setting takes effect only after a server restart. Restart the application server in the affected environment, then perform end-to-end validation of the Change Password flow. 

Step 4 — Restore obfuscation on pyPwdConfirmText if changed during troubleshooting 

If the control type on pyPwdConfirmText was changed to Text Input during investigation, revert it back to Password to restore field obfuscation. 

Step 5 — Repeat for each environment updated to 26.1.0 

The DSS must be created and a server restart performed in each environment (test, staging, production) as it is upgraded to Platform '26.1. To avoid manual recreation, include this DSS in the ruleset that is promoted through your deployment pipeline. 

Once the DSS setting is applied and the server is restarted, the two password properties will be exempted from the system page blocking and the Change Password modal will function correctly while keeping the security protection active for all other OperatorID properties. 

References

Auto-save not enabled when application Rule is password protected 

Operators and security