Spot the bug in password confirmation

const form = document.querySelector('#signup');
const password = document.querySelector('#password');
const confirmation = document.querySelector('#confirmation');

form.addEventListener('submit', (event) => {
  if (password.value !== confirmation.value) {
    confirmation.setCustomValidity('Passwords do not match');
    event.preventDefault();
  }
});