Getting "Invalid verification code." on password reset I've had a few users on our site have trouble resetting their password. They go through our "Forget password" flow on the front-end of our site, receive the reset email, which allows them to create a new password. But when they try sign in, they receive the following error:



Based on this thread, I thought the issue might have been our email parsing… but here's the weird thing… same thing happens when I grab the reset link directly from the control panel using this dialog then pasting it directly in a different (signed-out) browser:



I'm getting the exact same error every time I try it with either method (this was definitely working a few months ago on the same server, PHP version, etc).  Any ideas? Thanks!
In case anyone makes the same silly mistake I did, I had a conditional on the sign-in page that redirected folks to the page they were on before signing in.

After a password reset, it was trying to redirect back to the Set Password screen with the reset token, resulting in the error.

I just adjusted the conditional so it ignored the referrer URL if it was a control panel action. Problem solved.