Magento 2.3.5 admin password reset link expired

Question

If I try to reset password via admin login's "forgot password?" functionality, the link sent to reset password is expired immediately. I have the Recovery Link Expiration Period set to 10 hours. Any ideas?

Answer 1

There is a bug in the default email template vendor/magento/module-user/view/adminhtml/email/password_reset_confirmation.html

IS:

{{store url="admin/auth/resetpassword/" _query_id=$user.id _query_token=$user.rp_token _nosid=1}}

SHOULD:

{{store url="admin/auth/resetpassword/" _query_id=$user.user_id _query_token=$user.rp_token _nosid=1}}

Replace id with user_id.

Of course, you shouldn't do that change in the file directly (otherwise it's gone on the next update), but in a copy in your own theme or by using the "Email Templates" backend functionality.