In VASSAL 3.5.8 it’s possible to experience this bug even if all players have non-blank passwords, but the predefined setup from which the game was launched has a blank password embedded in it for an observer! See this thread for background.
The easiest solution is for all players to use the current version of VASSAL.