@Override
    protected Event doExecuteInternal(final RequestContext requestContext) throws Throwable {
        val passwordlessUserAccount = PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class);
        try {
            val token = requestContext.getRequestParameters().getRequired("token");
            val passwordlessToken = passwordlessTokenRepository.findToken(passwordlessUserAccount.getUsername())
                .orElseThrow(() -> new AuthenticationException("Unable to find passwordless token for " + passwordlessUserAccount.getUsername()));
            if (passwordlessToken.getToken().equalsIgnoreCase(token)) {
                handlePasswordlessAuthenticationAttempt(requestContext, passwordlessUserAccount, passwordlessToken);
                val finalEvent = super.doExecuteInternal(requestContext);
                passwordlessTokenRepository.deleteToken(passwordlessToken);
                return finalEvent;
            }
            throw new AuthenticationException("Provided token " + token + " is not issued by and does not belong to " + passwordlessUserAccount.getUsername());
        } catch (final Throwable e) {
            LoggingUtils.error(LOGGER, e);
            val attributes = new LocalAttributeMap<>();
            attributes.put("error", e);
            val request = PasswordlessAuthenticationRequest.builder()
                .username(passwordlessUserAccount.getUsername())
                .build();
            var account = passwordlessUserAccountStore.findUser(request);
            account.ifPresent(o -> attributes.put("passwordlessAccount", passwordlessUserAccount));
            return eventFactory.event(this, CasWebflowConstants.TRANSITION_ID_AUTHENTICATION_FAILURE, attributes);
        }
    }
This is {@link AcceptPasswordlessAuthenticationAction}.

@author Misagh Moayyed
@since 5.3.0
support/cas-server-support-passwordless-webflow/src/main/java/org/apereo/cas/web/flow/AcceptPasswordlessAuthenticationAction.java