content_image/682522.jpg content_image/682521.jpg
•Until the password reset occurs, the malicious user can access MySQL with the benign user’s changed credentials. 

Password-verification policy can be established globally, and individual accounts can be set to either defer to the global policy or override the global policy with specific per-account behavior. 

For each account, its mysql.user  row indicates whether there is an account-specific setting requiring verification of the current password for password change attempts. The setting is established by the PASSWORD REQUIRE  option of the CREATE USER  and ALTER USER  statements: 

•If the account setting is PASSWORD REQUIRE CURRENT , password changes must specify the current password. 

•If the account setting is PASSWORD REQUIRE CURRENT OPTIONAL , password changes may but need not specify the current password. 

•If the account setting is PASSWORD REQUIRE CURRENT DEFAULT , the password_require_current system variable determines the verification-required policy for the account: 

•If password_require_current  is enabled, password changes must specify the current password. 

•If password_require_current  is disabled, password changes may but need not specify the current password. 

In other words, if the account setting is not PASSWORD REQUIRE CURRENT DEFAULT , the account setting takes precedence over the global policy established by the password_require_current  system variable. Otherwise, the account defers to the password_require_current  setting. 

By default, password verification is optional: password_require_current  is disabled and accounts created with no PASSWORD REQUIRE  option default to PASSWORD REQUIRE CURRENT DEFAULT . 

The following table shows how per-account settings interact with password_require_current  system variable values to determine account password verification-required policy. 

<img src='content_image/682522.jpg'>

<img src='content_image/682521.jpg'>

## Note 

Privileged users can change any account password without specifying the current password, regardless of the verification-required policy. A privileged user is one 

