For those facing this problem. The website change password only require first 8 character of your original password. Dont enter more or it will give the above error. Once updated I think the database updates the data type and the exploit no longer seems to work. It will check and match the full new password.