It's actually not a bug. While 99% of the time you can just refer to the component ID you used in your markup, sometimes you have to be more specific. JSFUnit does a simple suffix match to find the component in an HTML page. UsingComponentIDs for all the details on handling client ID's.
Also see WritingJSFUnitTests.
In your case, you could just use ":password" to refer to the the password. Or use the enclosing naming container like "form1:password".