After updating to Magento 2.4.4, clicking the "Set new password" link in the "Forgot password mail" send by the system the link always shows as expired?!

Setting of "Recovery Link Expiration Period (hours) = 2 hours"

Seems like a bug to me. Does anyone see what is wrong in native Magento CreatePassword.php for example? Replacing "token" with "amp;token" does not help (as suggested by some for earlier versions)

CreatePassword.php in vendor/magento/module-customer/Controller/Account is as follows in Magento 2.4.4:

  public function __construct(
    Context $context,
    Session $customerSession,
    PageFactory $resultPageFactory,
    AccountManagementInterface $accountManagement,
    ConfirmCustomerByToken $confirmByToken = null,
    GetCustomerByToken $getByToken = null,
    CustomerRepositoryInterface $customerRepository = null
) {
    $this->session = $customerSession;
    $this->resultPageFactory = $resultPageFactory;
    $this->accountManagement = $accountManagement;
    $this->confirmByToken = $confirmByToken
        ?? ObjectManager::getInstance()->get(ConfirmCustomerByToken::class);
    $this->getByToken = $getByToken
        ?? ObjectManager::getInstance()->get(GetCustomerByToken::class);
    $this->customerRepository = $customerRepository
        ?? ObjectManager::getInstance()->get(CustomerRepositoryInterface::class);


 * Resetting password handler
 * @return Redirect|Page
public function execute()
    $resetPasswordToken = (string)$this->getRequest()->getParam('token');
    $customerId = (int)$this->getRequest()->getParam('id');
    $isDirectLink = $resetPasswordToken != '';
    if (!$isDirectLink) {
        $resetPasswordToken = (string)$this->session->getRpToken();
        $customerId = (int)$this->session->getRpCustomerId();

    try {
        $this->accountManagement->validateResetPasswordLinkToken($customerId, $resetPasswordToken);

        // Extend token validity to avoid expiration while this form is
        // being completed by the user.
        $customer = $this->customerRepository->getById($customerId);
        $this->accountManagement->changeResetPasswordLinkToken($customer, $resetPasswordToken);

        if ($isDirectLink) {
            $resultRedirect = $this->resultRedirectFactory->create();

            return $resultRedirect;
        } else {
            /** @var Page $resultPage */
            $resultPage = $this->resultPageFactory->create();

            return $resultPage;
    } catch (\Exception $exception) {
        $this->messageManager->addErrorMessage(__('Your password reset link has expired.'));
        /** @var Redirect $resultRedirect */
        $resultRedirect = $this->resultRedirectFactory->create();

        return $resultRedirect;
  • My issue was in my custom the (Porto) like @Maciej Lemiesz wrote
    – DanMar
    Commented Feb 1, 2023 at 15:39

5 Answers 5


Simple steps to overcome this problem

  1. Go to Admin dashboard
  2. Click on Marketing -> Email Templates
  3. Create new template by clicking on Add one Template

Template Name:

Forgot Admin Password(New)

Template Subject:

{{trans "Password Reset Confirmation for %name" name=$username}}

Template Content

{{trans "%name," name=$username}}

{{trans "There was recently a request to change the password for your account."}}

{{trans "If you requested this change, reset your password here:"}}

{{store url="admin/auth/resetpassword/" _query_id=$user.user_id _query_token=$user.rp_token _nosid=1}}

{{trans "If you did not make this request, you can ignore this email and your password will remain the same."}}

{{trans "Thank you,"}}

{{var store.frontend_name}}

Then go to Store -> Configuration -> Advanced -> Admin -> Admin User Emails

Change Forgot Password Email Template to newly created template

Forgot Admin Password(New)

Save and check

  • Unfortunately this does nothing. No link at all added in Magento 2.4.4. - See Bhargavs answer below. That at least solves the link problem. Unfortunately not the link expiry problem.
    – Ben
    Commented May 17, 2022 at 12:53
  • 1
    Good news. We found the culprit. Error was caused by an extension by "IT Recht Kanzlei" from Cyberday which we are using for our legal texts. Deactivating this extension and the error is gone. Finally found this out after looking into so many options in the code.
    – Ben
    Commented May 18, 2022 at 14:46
  • Good to hear that your issue got resolve Commented May 19, 2022 at 15:03
  • Thanks, it works for me. For Magento 2.4.3 -p2 version I used below link :- {{var this.getUrl($store,'customer/account/createPassword/',[_query:[id:$customer.id,token:$customer.rp_token],_nosid:1])}} Commented Oct 18, 2022 at 5:38

In my case I had to change my custom theme (porto) file: app/design/frontend/Smartwave/porto/Magento_Customer/templates/form/resetforgottenpassword.phtml

and introduce new form param id like following:

['id' => $block->getRpCustomerId(), 'token' => $block->getRequest()->getParam("token")]
  • Better use ['id'=>$block->getRpCustomerId(),'token' => $block->getResetPasswordLinkToken()] . See original template: ./vendor/magento/module-customer/view/frontend/templates/form/resetforgottenpassword.phtml
    – schnere
    Commented Apr 12, 2023 at 9:41

magento 2.4.4 has changed email template variables, compare email templates from vendor module and make changes if you have override them

  • Thank you for the hint. The code indeed is indeed different in the e-mail template variable from vendor.
    – Ben
    Commented May 17, 2022 at 12:26
  • 2
    When loading templates for forgot e-mail after update to Magento 2.4.4 varibable differs from vendor variable: <a href="{{var this.getUrl($store,'customer/account/createPassword**/**',[_query:[id:$customer.id,token:$customer.rp_token],_nosid:1])}}" target="_blank">{{trans "Set a New Password"}}</a> Variable from /vendor/magento/module-customer/view/frontend/email --> PasswordReset.html it differs: `<a href="{{var this.getUrl($store,'customer/account/createPassword',[_query:[id:$customer.id,token:$customer.rp_token],_nosid:1])}}" target="_blank">{{trans "Set a New Password"}}</a>
    – Ben
    Commented May 17, 2022 at 12:27
  • So old instance adds a "/" behind password which then hinders to function properly. Now it works with the link. BUT: However, weird when I add any given links as per <a href="magento.stackexchange.com"</a> in e-mail template still the "h" in "https" gets cut in the mail I receive (in Thunderbird) Even more weird: Could you check to send Password reset link to any given Gmail address? It seems that link is removed then and arrives as <a>LINK</a>
    – Ben
    Commented May 17, 2022 at 12:27

I had a similar issue after overriding the template in


I just added a div-Container there and it caused the reset-password site to not execute properly. Removing the customized phtml solved the issue.


I get this issue with Magento 2.4.5-p1 I custom email template then the issue happens. The cause by email template. Reset email template to default email template content then it works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.