@Override
    public boolean isValid(final PasswordChangeRequest bean) throws Throwable {
        if (!StringUtils.hasText(bean.toPassword())) {
            LOGGER.error("Provided password is blank");
            return false;
        }
        if (bean.getCurrentPassword() != null && bean.toPassword().equals(bean.toCurrentPassword())) {
            LOGGER.error("Provided password cannot be the same as the current password");
            return false;
        }
        if (!bean.toPassword().equals(bean.toConfirmedPassword())) {
            LOGGER.error("Provided password does not match the confirmed password");
            return false;
        }

        if (!isAcceptedByPasswordPolicy(bean.toPassword())) {
            LOGGER.error("Provided password does not match the pattern required for password policy");
            return false;
        }

        if (passwordHistoryService.exists(bean)) {
            LOGGER.error("Recycled password from password history is not allowed for [{}]", bean.getUsername());
            return false;
        }
        return validatePassword(bean);
    }
This is {@link DefaultPasswordValidationService}.

@author Misagh Moayyed
@since 6.0.0
support/cas-server-support-pm-core/src/main/java/org/apereo/cas/pm/impl/DefaultPasswordValidationService.java