To workaround the issue you can add the field as an input to the cloud template:
1. Add the desired field as an input to the cloud template and set the encrypted property to true.
2. Leverage this input in the Service broker custom form
3. This will then mask the value entered under Deployment -> User Events.
See sample blueprint code below for password confirmation inputs: