@Override
    protected Event doExecuteInternal(final RequestContext requestContext) {
        try {
            val transientTicket = requestContext.getRequestParameters()
                .get(PasswordManagementService.PARAMETER_PASSWORD_RESET_TOKEN);
            if (StringUtils.isNotBlank(transientTicket)) {
                val tst = ticketRegistry.getTicket(transientTicket, TransientSessionTicket.class);
                val token = tst.getProperties().get(PasswordManagementService.PARAMETER_TOKEN).toString();
                val username = passwordManagementService.parseToken(token);
                if (StringUtils.isBlank(username)) {
                    throw new IllegalArgumentException("Password reset token could not be verified to determine username");
                }
                return eventFactory.event(this, CasWebflowConstants.TRANSITION_ID_RESET_PASSWORD);
            }
            val doChange = requestContext.getRequestParameters()
                .get(PasswordManagementService.PARAMETER_DO_CHANGE_PASSWORD);
            if (StringUtils.isNotBlank(doChange) && BooleanUtils.toBoolean(doChange)) {
                return eventFactory.event(this, CasWebflowConstants.TRANSITION_ID_RESET_PASSWORD);
            }

            return null;
        } catch (final Exception e) {
            LoggingUtils.warn(LOGGER, e);
            return eventFactory.event(this, CasWebflowConstants.TRANSITION_ID_INVALID_PASSWORD_RESET_TOKEN);
        }
    }
This is {@link ValidatePasswordResetTokenAction}.

@author Misagh Moayyed
@since 6.3.0
support/cas-server-support-pm-webflow/src/main/java/org/apereo/cas/pm/web/flow/actions/ValidatePasswordResetTokenAction.java