After updating to Magento 2.4.4, clicking the "Set new password" link in the "Forgot password mail" send by the system the link always shows as expired?!

Setting of "Recovery Link Expiration Period (hours) = 2 hours"

Seems like a bug to me. Does anyone see what is wrong in native Magento CreatePassword.php for example? Replacing "token" with "amp;token" does not help (as suggested by some for earlier versions)

CreatePassword.php in vendor/magento/module-customer/Controller/Account is as follows in Magento 2.4.4:

  public function __construct(
    Context $context,
    Session $customerSession,
    PageFactory $resultPageFactory,
    AccountManagementInterface $accountManagement,
    ConfirmCustomerByToken $confirmByToken = null,
    GetCustomerByToken $getByToken = null,
    CustomerRepositoryInterface $customerRepository = null
) {
    $this->session = $customerSession;
    $this->resultPageFactory = $resultPageFactory;
    $this->accountManagement = $accountManagement;
    $this->confirmByToken = $confirmByToken
        ?? ObjectManager::getInstance()->get(ConfirmCustomerByToken::class);
    $this->getByToken = $getByToken
        ?? ObjectManager::getInstance()->get(GetCustomerByToken::class);
    $this->customerRepository = $customerRepository
        ?? ObjectManager::getInstance()->get(CustomerRepositoryInterface::class);


 * Resetting password handler
 * @return Redirect|Page
public function execute()
    $resetPasswordToken = (string)$this->getRequest()->getParam('token');
    $customerId = (int)$this->getRequest()->getParam('id');
    $isDirectLink = $resetPasswordToken != '';
    if (!$isDirectLink) {
        $resetPasswordToken = (string)$this->session->getRpToken();
        $customerId = (int)$this->session->getRpCustomerId();

    try {
        $this->accountManagement->validateResetPasswordLinkToken($customerId, $resetPasswordToken);

        // Extend token validity to avoid expiration while this form is
        // being completed by the user.
        $customer = $this->customerRepository->getById($customerId);
        $this->accountManagement->changeResetPasswordLinkToken($customer, $resetPasswordToken);

        if ($isDirectLink) {
            $resultRedirect = $this->resultRedirectFactory->create();

            return $resultRedirect;
        } else {
            /** @var Page $resultPage */
            $resultPage = $this->resultPageFactory->create();

            return $resultPage;
    } catch (\Exception $exception) {
        $this->messageManager->addErrorMessage(__('Your password reset link has expired.'));
        /** @var Redirect $resultRedirect */
        $resultRedirect = $this->resultRedirectFactory->create();

        return $resultRedirect;

2 Answers 2


magento 2.4.4 has changed email template variables, compare email templates from vendor module and make changes if you have override them

  • Thank you for the hint. The code indeed is indeed different in the e-mail template variable from vendor.
    – Ben
    May 17 at 12:26
  • When loading templates for forgot e-mail after update to Magento 2.4.4 varibable differs from vendor variable: <a href="{{var this.getUrl($store,'customer/account/createPassword**/**',[_query:[id:$customer.id,token:$customer.rp_token],_nosid:1])}}" target="_blank">{{trans "Set a New Password"}}</a> Variable from /vendor/magento/module-customer/view/frontend/email --> PasswordReset.html it differs: `<a href="{{var this.getUrl($store,'customer/account/createPassword',[_query:[id:$customer.id,token:$customer.rp_token],_nosid:1])}}" target="_blank">{{trans "Set a New Password"}}</a>
    – Ben
    May 17 at 12:27
  • So old instance adds a "/" behind password which then hinders to function properly. Now it works with the link. BUT: However, weird when I add any given links as per <a href="magento.stackexchange.com"</a> in e-mail template still the "h" in "https" gets cut in the mail I receive (in Thunderbird) Even more weird: Could you check to send Password reset link to any given Gmail address? It seems that link is removed then and arrives as <a>LINK</a>
    – Ben
    May 17 at 12:27

Simple steps to overcome this problem

  1. Go to Admin dashboard
  2. Click on Marketing -> Email Templates
  3. Create new template by clicking on Add one Template

Template Name:

Forgot Admin Password(New)

Template Subject:

{{trans "Password Reset Confirmation for %name" name=$username}}

Template Content

{{trans "%name," name=$username}}

{{trans "There was recently a request to change the password for your account."}}

{{trans "If you requested this change, reset your password here:"}}

{{store url="admin/auth/resetpassword/" _query_id=$user.user_id _query_token=$user.rp_token _nosid=1}}

{{trans "If you did not make this request, you can ignore this email and your password will remain the same."}}

{{trans "Thank you,"}}

{{var store.frontend_name}}

Then go to Store -> Configuration -> Advanced -> Admin -> Admin User Emails

Change Forgot Password Email Template to newly created template

Forgot Admin Password(New)

Save and check

  • Unfortunately this does nothing. No link at all added in Magento 2.4.4. - See Bhargavs answer below. That at least solves the link problem. Unfortunately not the link expiry problem.
    – Ben
    May 17 at 12:53
  • Good news. We found the culprit. Error was caused by an extension by "IT Recht Kanzlei" from Cyberday which we are using for our legal texts. Deactivating this extension and the error is gone. Finally found this out after looking into so many options in the code.
    – Ben
    May 18 at 14:46
  • Good to hear that your issue got resolve
    – Arun Kumar
    May 19 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.