code: public function resetPasswordAction()
      {
          // if the user is logged in, we can't reset password
          if ($this->cmsAuthentication()->hasIdentity()) {
              // redirect to the defualt user route
              return $this->redirect()->toRoute($this->getOptions()->getDefaultUserRoute());
          }
  
          if ($token = $this->params()->fromRoute('token')) {
              $identity = $this->getUserService()->confirmPasswordReset($token);
              if ($identity instanceof ResponseInterface) {
              	return $identity;
              } elseif ($identity) {
                  $viewModel = new ViewModel(compact('identity'));
                  $viewModel->setTemplate('cms-user/authentication/reset-password-success');
              	return $viewModel;
              }
  
              return $this->redirect()->toRoute();
          }
  
          $url = $this->url()->fromRoute();
          $prg = $this->prg($url, true);
          if ($prg instanceof ResponseInterface) {
              return $prg;
          }
  
          $post = $prg;
          $form = $this->getUserService()->getResetPasswordForm();
          $form->setAttribute('action', $url);
  
          if ($post && $form->setData($post)->isValid()) {
  
              $identity = $this->getUserService()->resetPassword($form->get('identity')->getValue());
  
              // Return early if an user service returned a response
              if ($identity instanceof ResponseInterface) {
                  return $identity;
              } elseif ($identity) { // Password reset successfully
                  $viewModel = new ViewModel(compact('identity'));
                  $viewModel->setTemplate('cms-user/authentication/reset-password-warning');
                  return $viewModel;
              }
          }
  
          return new ViewModel(compact('form'));
      }
docs: Reset password action
  
  Displays user reset password form and sends email with reset link to user
  
  @return array|ResponseInterface|ViewModel