Quantum password authentication against man-in-the-middle attack

Authentication with recently proposed quantum password protocol is secure against impersonation. Here we show that original version of the protocol is not secure against active malicious prover and verifier, however a slight modification provides a possibility for a legitimate party to detect the attacks. The password is reusable in the absence of the attacks. Otherwise the security of the authentication scheme should be provided by password change. In this way the overall scheme becomes resistant to man-in-the-middle attack.