Recently, Liu and Xue proposed a secure two-party password-based authenticated key exchange protocol by utilizing the semi-group property of the Chebyshev chaotic maps. We exploit the vulnerability of the protocol in this paper by illustrating an off-line password guessing attack. In this attack, the password of a honest user will be recover by an attacker without being noticed by the server or the victim. To overcome such problem, we propose a simple and compatible fix.