protected boolean doesPasswordResetRequireMultifactorAuthentication(final RequestContext requestContext) throws Throwable {
        val applicationContext = requestContext.getActiveFlow().getApplicationContext();
        val providers = MultifactorAuthenticationUtils.getAvailableMultifactorAuthenticationProviders(applicationContext);
        val providerId = MultifactorAuthenticationWebflowUtils.getMultifactorAuthenticationProvider(requestContext);
        var mfaRequired = casProperties.getAuthn().getPm().getReset().isMultifactorAuthenticationEnabled()
            && !providers.isEmpty() && StringUtils.isBlank(providerId);
        if (mfaRequired) {
            val query = WebUtils.getPasswordManagementQuery(requestContext, PasswordManagementQuery.class);
            val principal = resolvedPrincipal(query.getUsername());
            val provider = selectMultifactorAuthenticationProvider(requestContext, principal);
            val service = WebUtils.getService(requestContext);
            val registeredService = servicesManager.findServiceBy(service);
            if (service != null) {
                RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(service, registeredService);
            }

            val authentication = new DefaultAuthenticationBuilder(principal)
                .addCredential(new BasicIdentifiableCredential(query.getUsername()))
                .build();
            val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);
            val bypassEvaluator = provider.getBypassEvaluator();
            mfaRequired = bypassEvaluator == null || bypassEvaluator.shouldMultifactorAuthenticationProviderExecute(authentication, registeredService, provider, request, service);
        }
        return mfaRequired;
    }
Build the reset URL for the user.
support/cas-server-support-pm-webflow/src/main/java/org/apereo/cas/pm/web/flow/actions/SendPasswordResetInstructionsAction.java