AbleCommerce Shopping Cart Software

We're running AC 7.0.2 and I found something in testing that appears very wrong on the one page checkout. Though the page is customized, we haven't removed or modified the NewUserPasswordValidator that ensures the password is retyped to match. We have added a second validation summary to the page below the credit card payment control that just repeats any CreateAccount validation errors. But the order can be submitted without the passwords matching.

Can someone test this and let me know if this is a bug in our site or in AC's code?

Here are the steps to reproduce:

• Make sure you aren't logged in and that Allow Anonymouse Checkout is true.
• Add something to cart and proceed to checkout
• Enter billing address and select shipping same as billing
• Do not check the checkbox.
• fill in the password with a valid password (say, Able702!)
• fill in the retype password with a different valid password (say, Able702!!!)
• enter in valid test credit card info and submit the order

On our site, the order is submitted without any problem and appears as paid in admin. The checkout doesn't prevent the user from submitting the order. I don't think it's just because of the validation group, because if the user doesn't fill in any password, the password required validator does fire and it's the same validation group as the compare validator, which is "CreateAccount".

Am I missing something? Thanks in advance.