Steps to reproduce the issue

Audit finding

When setting the administrator password during Joomla installation, the password must contain at least 12 characters.

The requirement is not associated with the password field in a way that assistive technology can expose while the user is creating or entering the password.

If the password is shorter than 12 characters, assistive-technology users may receive only “This value is not valid.” An <output> element may announce “Password doesn’t meet the site’s requirements,” but neither message identifies the 12-character requirement.

The report recommends associating the requirement “Enter at least 12 characters” with the password field using aria-describedby, pointing to the message's id. It also suggests considering autocomplete="new-password".

User impact

Screen-reader users may not learn that the administrator password must contain at least 12 characters before or while entering it.

They may enter a shorter password, submit the form, and receive a generic error that does not explain how to correct it. They may need to experiment repeatedly to discover the requirement.

This creates a significant barrier during installation, because the administrator password is required to complete setup and cannot be recovered through the normal installation flow.

The issue affects the accuracy and completeness of error identification, as well as the availability of instructions before submission.

Remediation plan

Associate the password requirement and field-specific validation with each password field

• Associate the visible requirement “Enter at least 12 characters” with each password field using aria-describedby
• Give the requirement message a stable id and reference that id from the relevant field
• Ensure the requirement is available before the user submits the form
• Ensure field-specific validation identifies the field and explains the failed requirement
• Replace or supplement generic messages such as “This value is not valid” with actionable information, such as the minimum character count
• Ensure the <output> status message identifies the unmet requirement rather than only stating that the password does not meet site requirements
• Keep the requirement, field, and status message in a meaningful sequence
• Ensure both password and confirmation password fields receive the appropriate requirement and error information
• Consider autocomplete="new-password" for password-creation fields where appropriate
• Preserve secure handling of password values and avoid exposing their contents
• Verify the behaviour with keyboard-only interaction and with screen readers
• Do not rely on placeholder text alone to convey the requirement

Preconditions

• Use Joomla 6.2
• Start the Joomla installation process on a test environment
• Reach the step that creates the administrator account
• Locate the password and confirmation password fields
• Record the exact Joomla build, browser name and version, operating system, viewport dimensions, and browser zoom
• Record the screen reader and browser combination if testing announcements
• Start at 100% browser zoom
• Use a disposable installation environment
• Do not complete an installation into a production environment

Steps to reproduce

1. Open the Joomla installation URL in a browser
2. Proceed to the step that creates the administrator account
   • Record the exact step label and URL in the tested build
3. Locate the administrator password field and its confirmation field
4. Locate the visible password requirement
5. Inspect each password field using Developer Tools
6. Record the field's type, id, aria-describedby, autocomplete, and associated <label>
7. Record the requirement message's id and text
8. Check whether the requirement message is referenced by aria-describedby
9. Enter a password shorter than 12 characters
10. Trigger validation according to the interface, such as moving focus away or attempting to continue
11. Record the validation message or messages presented
12. Check whether the message identifies the minimum length requirement
13. Inspect the <output> element and record its text and relationship to the field
14. Capture the field, requirement, validation message, and relevant DOM attributes
15. Repeat for the confirmation password field if it uses the same requirement
16. Do not submit the installation form with a password that would create an unwanted administrator account

Screen-reader verification

1. Use a screen reader with the browser combination being tested
2. Navigate to the password field
3. Record the field's announced label, role, and description
4. Check whether the 12-character requirement is announced when the field receives focus
5. Enter a password shorter than 12 characters
6. Trigger validation and record the announced error or status message
7. Check whether the announcement identifies the minimum length requirement
8. Repeat for the confirmation password field
9. Navigate away from and back to the field to check whether the requirement remains available
10. Record the screen-reader name, version, browser, and operating system
11. Do not submit the installation form with an unintended password

Verification after remediation

1. Navigate to the administrator password field
2. Confirm that “Enter at least 12 characters” is programmatically associated with the field
3. Confirm that a screen reader announces the requirement when appropriate
4. Enter a password shorter than 12 characters and trigger validation
5. Confirm that the error identifies the minimum-length requirement and the affected field
6. Enter a valid password and confirm that the error state clears appropriately
7. Repeat for the confirmation password field
8. Confirm that keyboard operation, label association, and focus behaviour remain intact
9. Record the final DOM relationships, messages, and screen-reader announcements

Version

6.2

Expected result

Each administrator password field in the Joomla Installer has its minimum-length requirement programmatically associated with it.

Assistive-technology users can learn that the password must contain at least 12 characters before or while entering it.

If validation fails, the error identifies the affected field and explains the unmet requirement, including the minimum character count.

Actual result

The 12-character requirement is not associated with the password fields in a way that assistive technology can convey during password creation or entry.

When the password is too short, users may receive only “This value is not valid.” The <output> element announces only “Password doesn’t meet the site’s requirements.”

Neither message identifies the 12-character requirement.

The current Joomla 6.2 installation flow needs to be checked to establish whether the issue persists.

What device were you using? (eg, phone, laptop)

Desktop web

What web browser were you using? (eg, Chrome, Safari)

Chrome, Firefox, Edge, Safari

Assistive Technology?

VoiceOver, JAWS, NVDA

Additional Comments

The browser and assistive-technology entries above are carried forward from the original issue and do not represent a new verification of every combination against Joomla 6.2.

Development is the responsibility tag in the original report.

The report's suggested aria-describedby approach and autocomplete="new-password" are recommendations, not the only possible implementation. Verify the chosen approach with assistive technology.

The issue concerns the Joomla Installer's administrator password fields. Do not assume that password fields elsewhere in Joomla have the same implementation or the same failure.

MS2b is proposed for the shared password-field component, with MS3b covering the documented Installer integration.