If you already have the username and old password that you want to check, I just attempt to retrieve an access token. If it works, you know the old password is correct, then you can proceed in changing the password.
POST - /auth/realms/{realm}/protocol/openid-connect/token
headers.set("content-type", "application/x-www-form-urlencoded");
headers.set("accept", "application/json");
body.add("grant_type", “password”)
body.add("username", username);
body.add("password", password);
body.add(“client_id”, {clientId})