code: public function processForgotten(string $hash, string $password): bool
      {
          $decode = $this->getDecodeHash($hash);
  
          $id = (int) $decode['id'];
          $verifyHash = $decode['verifyHash'];
  
          $item = $this->getById($id);  // load row from db
          if ($item && $id == $item['id']) { // not null result
              $values['hash'] = $this->getHash($password);  // auto hash password
              if ($this->verifyHash($item['id'] . $item['login'], $verifyHash)) {  // check hash and password
                  return $this->update($item['id'], $values);    // final save user
              } else {
                  throw new IdentityException('Invalid hash!');
              }
          } else {
              throw new IdentityException('User does not exist!');
          }
      }
docs: Process forgotten.
  
  @param string $hash
  @param string $password
  @return bool
  @throws IdentityException
  @throws \Dibi\Exception