Check the route path provided for change_pwd_page.reset route in change_pwd_page.routing.yml
i.e. /user/reset/{uid}/{timestamp}/{hash}/new/login
Now check the route path being set for reset password in src/Routing/RouteSubscriber::alterRoutes.
i.e. /user/reset/{uid}/{timestamp}/{hash}/new
Its different. /login is missing, which is resulting in redirecting to user edit page instead running the code in ChangePwdPageController::resetPass(). Password Reset functionality provided by this module is not being used at all.
Install Password Separate Form 2.x and check reset password functionality.
I understand why the urls are different after looking into #3153398 → . But #3153398 was done to fix regression from #2910045 →
But, currently I am on latest Drupal 9.5.x and 2.x of Password Separate Form module. And I checked running drush uli. It runs perfectly now. I assume the underlying issue of #3153398 and #2910045 has already been fixed. So in that case, it does not make sense to use separate url for RouteSubscriber::alterRoutes and we should make them same.
2.0
Code
+1 having the same issue. The patch works.
I experienced the same behaviour. Patch fixes this.
Patch still works with Drupal 10.2
IMHO this is so important, that it should be released ASAP.