Password Management •Until the password reset occurs, the malicious user can access MySQL with the benign user’s changed credentials. •If the account setting is  PASSWORD REQUIRE CURRENT , password changes must specify the current password. •If the account setting is  PASSWORD REQUIRE CURRENT OPTIONAL , password changes may but need not specify the current password. •If the account setting is  PASSWORD REQUIRE CURRENT DEFAULT , the  password_require_current system variable determines the verification-required policy for the account: •If  password_require_current  is enabled, password changes must specify the current password. •If  password_require_current  is disabled, password changes may but need not specify the current password. 1250 Privileged users can change any account password without specifying the current password, regardless of the verification-required policy. A privileged user is one The following table shows how per-account settings interact with  password_require_current  system variable values to determine account password verification-required policy. By default, password verification is optional:  password_require_current  is disabled and accounts created with no  PASSWORD REQUIRE  option default to  PASSWORD REQUIRE CURRENT DEFAULT . In other words, if the account setting is not  PASSWORD REQUIRE CURRENT DEFAULT , the account setting takes precedence over the global policy established by the  password_require_current  system variable. Otherwise, the account defers to the  password_require_current  setting. Password-verification policy can be established globally, and individual accounts can be set to either defer to the global policy or override the global policy with specific per-account behavior. For each account, its  mysql.user  row indicates whether there is an account-specific setting requiring verification of the current password for password change attempts. The setting is established by the PASSWORD REQUIRE  option of the  CREATE USER  and  ALTER USER  statements: Table 6.10 Password-Verification Policy Note Per-Account Setting password_require_current System Variable Password Changes Require Current Password? PASSWORD REQUIRE CURRENT OFF Yes PASSWORD REQUIRE CURRENT ON Yes PASSWORD REQUIRE CURRENT OPTIONAL OFF No PASSWORD REQUIRE CURRENT OPTIONAL ON No PASSWORD REQUIRE CURRENT DEFAULT OFF No PASSWORD REQUIRE CURRENT DEFAULT ON Yes