It’s exactly as exploitable as a standard password reset flow, except that if you reset someone’s password, they’ll probably notice their current password not working anymore.