This all is bad in many ways as you build your personal man-in-the-middle 
Better solution:
Leave all to Keycloak, implement your own custom UpdatePassword Required Action by extending the existing/built-in one and overwriting the getMaxAuthAge() method only (or also the order() method) an return 0. Leave the ID of the action as is.
This way, Keycloak will always ask first for the existing password and you don’t have to deal with man-in-the-middle.
Also, don’t do “login” with the man-in-the-middle-apporach. Read and understand the spec and concept behind OAuth2 and OIDC. Don’t argue with “but…”. That’s always wrong.