after using the karaf cli to change the password which works, I also noticed the old password
still works.

quick repro:

access restconf with default admin/admin credentials

curl -u "admin:admin" http://localhost:8181/restconf/streams
{"streams":{}}

change password (to admin123) in karaf console

opendaylight-user@root>aaa:change-user-pwd -user admin
Enter current password:
Enter new password:
admin's password has been changed
opendaylight-user@root>

you can see that both the new password and old password still work

curl -u "admin:admin" http://localhost:8181/restconf/streams
{"streams":{}}

curl -u "admin:admin123" http://localhost:8181/restconf/streams
{"streams":{}}