Assuming you want to replace password (in your example) with $usernewpwd, you need to make sure you preserve the "xdbns='jabber:iq:auth'>" and "<" parts, by including them in the replacement. So:

s/xdbns='jabber:iq:auth'>.*?</xdbns='jabber:iq:auth'>$usernewpwd</g;
[download]

or

s/(xdbns='jabber:iq:auth'>).*?(<)/$1$usernewpwd$2/g;
[download]

Note that I changed .* to .*?; this will cause it to prefer to stop matching at the first < instead of going on to a later < on the line.

Have you considered quoting issues? E.g. if a password actually contains a character like "<", what will whatever usually builds the file put there? And can you do it the same way to $usernewpwd, and adjust the regex to handle it? It might be better to look to one of the fine XML modules available on CPAN, than do it by hand.

Update: And as Boris says, you need to make sure to actually write out the changed lines to a new file.