Custom “wp_login.php?action=lostpassword” and reset password

try it:

Runs after the user submits a new password during password reset but before the new password is actually set.

https://codex.wordpress.org/Plugin_API/Action_Reference/password_reset