This feels like a duplicate of XWIKI-19077: Andreas Jonsson maybe you were not aware of the configuration documented in https://extensions.xwiki.org/xwiki/bin/view/Extension/Authentication%20Security%20Module/#HResetpassword to avoid burning right away the token?