My engl. is not the best but i try to describe my Problem:

1. Administrator resets password for User Xy
2. Mail to User with following verification URL

http://www.server.de/mantis/verify.php?id=4&confirm_hash=edf6bdfa08f56f30cc8030c299179b38

3. Modify "verify.php" for debuging:

//---------------------------------------------------------
// MY DEBUG CODE
echo "--> ". $f_confirm_hash ." <--> ". $t_calculated_confirm_hash." <-";

// YOUR HASH CHECK
if ( $f_confirm_hash != $t_calculated_confirm_hash ) {
trigger_error( ERROR_LOST_PASSWORD_CONFIRM_HASH_INVALID, ERROR );
}
//---------------------------------------------------------

4. Klick to URL & server response 2 different hashs:

--> edf6bdfa08f56f30cc8030c299179b38 <--> 5dc3fb2309d863403a5996a424854ccc <-

5. try this 3x:

URL:
1x...mantis/verify.php?id=4&confirm_hash=0f914c339ccfea0d926f5c116e9a789c
2x...mantis/verify.php?id=4&confirm_hash=5d2664151183b50498932b17220b075c
3x...mantis/verify.php?id=4&confirm_hash=9df0f24cae2c3723cea25312556c884c

Server:
1x APPLICATION ERROR #1901
2x APPLICATION ERROR #1901
3x APPLICATION ERROR #1901

My debug:
1x--> 0f914c339ccfea0d926f5c116e9a789c <--> ea844ea2bf23704ac6c4d977ceb582fe <-

2x--> 5d2664151183b50498932b17220b075c <--> b1ae52a50d2725f97433ca9460fec800 <-

3x--> 9df0f24cae2c3723cea25312556c884c <--> bee7814232ef32d52524aad91a6618aa <-

... I think you use different functions when reset and when verify...

thanks
Danijel