During the password change PAM procedure, the prompt “Enter new password” is not handled correctly by the NoMachine server as a request to provide a new password. Instead, the server falls back to the “two-factor authentication required” flow.

As a consequence the client UI shows a dialog labeled "Two-Factor Authentication" and asks the user to enter an "Authentication code", which is misleading. However, providing the same new password twice is accepted, and the password is changed.