diff --git a/docs/UAA-APIs.rst b/docs/UAA-APIs.rst
index 4835dfd30e8..bfb8adaa1f2 100644
--- a/docs/UAA-APIs.rst
+++ b/docs/UAA-APIs.rst
@@ -2124,6 +2124,10 @@ Change Email Flow:
             "email": "example@newemail.com"
         }
 
+* ``redirect_url`` is the requested ``redirect_uri`` when it matches one of the client's registered redirect URIs.
+  Otherwise, it is the value of the client's ``change_email_redirect_url`` attribute, or ``null`` when the client has
+  no such attribute or no client was given.
+
 * Response Codes::
 
         200 - OK
@@ -2136,6 +2140,55 @@ Change Email Flow:
         $ curl 'http://localhost:8080/email_changes' -i -X POST -H 'Content-Type: application/json' -d 6FfI4o
 
 
+Create a Code: ``POST /Codes``
+------------------------------
+
+Stores a one time code and returns it. Codes are stored per identity zone and can be read back once with ``GET /Codes/{code}``.
+
+* Request: ``POST /Codes``
+
+* Authorization: a token with the scope ``oauth.login`` or a UAA admin token.
+
+* Request Body::
+
+        {
+          "data": "{\"user_id\":\"a-user-id\"}",
+          "expiresAt": 4102444800000,
+          "intent": "MY_APPLICATION_CODE"
+        }
+
+  ``data`` (required) is stored with the code, as a string. ``expiresAt`` (required) is milliseconds since the epoch and must be in the future.
+  ``intent`` (required, not blank) says what the code may be used for.
+
+* Intents:
+
+  The UAA flows accept a code only when its intent matches the flow, and the match is case sensitive:
+
+  * ``EMAIL``: email change verification (``POST /email_changes`` and ``/verify_email``)
+  * ``INVITATION``: invitation acceptance (``/invitations/accept``)
+  * ``REGISTRATION``: account activation (``/verify_user``)
+
+  Any other value is stored as given; use it for codes that your own application creates and redeems.
+  Intents that the UAA creates for its own flows (for example the ones for password reset, autologin and passcodes) are also stored as given.
+  Codes stored without an intent before this requirement was added remain redeemable until they expire.
+
+* Response Codes::
+
+        201 - Created
+        400 - Bad Request (the intent is missing or blank, data or expiresAt are missing, or expiresAt is in the past)
+        401 - Unauthorized
+        403 - Forbidden
+
+* Error message for a missing intent::
+
+        intent is required. Known intents: EMAIL, INVITATION, REGISTRATION; custom values are accepted.
+
+* Example CURL ::
+
+        $ curl 'http://localhost:8080/Codes' -i -X POST -H 'Content-Type: application/json' -H 'Authorization: Bearer <token>' \
+            -d '{"data":"{}","expiresAt":4102444800000,"intent":"MY_APPLICATION_CODE"}'
+
+
 Verify User Links: ``GET /Users/{id}/verify-link``
 --------------------------------------------------
 
@@ -2144,8 +2197,8 @@ Verify User Links: ``GET /Users/{id}/verify-link``
 
 * Request Parameters::
 
-        client_id; the id of the client requesting the verification link (optional)
-        redirect_uri; the eventual URI that will be redirected after the user finishes resetting their password (optional)
+        client_id; the id of the client requesting the verification link (optional; defaults to the client id from the OAuth2 bearer token when available)
+        redirect_uri; the eventual URI that will be redirected after the user finishes resetting their password (required)
                       the redirect_uri whitelist that can be set per client accepts wildcards, and matches against this redirect_uri using Ant-style path pattern matching (as per <http://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/util/AntPathMatcher.html>)
 
 * Request Headers: Authorization header containing an `OAuth2`_ bearer token with::
@@ -2353,6 +2406,28 @@ The redirect_uri will be validated against allowed redirect_uri for the client.
         "failed_invites":[]
     }
 
+.. note::
+
+   **Verified users and** ``scim.invite.allow_reinvite``
+
+   By default an email address that belongs to a verified user is invited like any other address: the response
+   contains the user's ``userId`` and a new ``inviteLink``. When the server sets ``scim.invite.allow_reinvite: false``
+   and the token has ``scim.invite`` but may not read users (``GET /Users`` would refuse it, for example because it has
+   neither ``scim.read`` nor the zone administrator scope), the address is reported in ``failed_invites`` instead. No
+   user id or link is returned and no invitation is created::
+
+       {
+           "new_invites":[],
+           "failed_invites":[
+               {"email":"user1@cqv4f7.com","userId":null,"origin":null,"success":false,"errorCode":"user.already-verified","errorMessage":"The user is already verified.","inviteLink":null}
+           ]
+       }
+
+   The other addresses of the request are processed as usual, and users who are not verified yet, as well as new
+   users, are always invited. A client that re-invites existing users and needs the user id or the link should hold
+   ``scim.read`` before the property is set to ``false``. See ``scim.invite.allow_reinvite`` in
+   ``docs/UAA-Configuration-Reference.md``.
+
 .. note::
 
    **Existing unverified UAA-origin users and password handling**
@@ -2372,6 +2447,26 @@ The redirect_uri will be validated against allowed redirect_uri for the client.
    Newly created users (first-time invitations where the account did not exist
    before) are unaffected: the supplied password is set normally.
 
+.. note::
+
+   **Accepting an invitation through an external identity provider**
+
+   When the invited user accepts the invitation by signing in at a SAML or OIDC provider, the response of the provider
+   must carry an email address, and it must match the invited email address (the comparison ignores case). A sign-in that
+   carries a different address is rejected.
+
+   * SAML: if the assertion has no email attribute, there is no address to compare. UAA then accepts the sign-in only
+     when the invited account is still unverified and its username equals the invited email address. That is the state
+     of an account created by an invitation that has not been accepted yet. Any other account is rejected: one that is
+     verified, or one whose username differs from its email address.
+
+     UAA does not record whether the invitation created the account, so an existing account in the same state is
+     accepted too. UAA marks a SAML user verified only when the provider's ``email_verified`` attribute says so. To have
+     every acceptance compared with the invited address, map the ``email`` attribute for the provider.
+   * OIDC: if the token has no email claim, UAA derives an address from the username claim. That address has to match
+     the invited email address as well, so a token without an email claim only works when the username claim equals the
+     invited email address.
+
 
 
 Group Management APIs
diff --git a/docs/UAA-Configuration-Reference.md b/docs/UAA-Configuration-Reference.md
index 6d0abce0c9c..482ee05ad08 100644
--- a/docs/UAA-Configuration-Reference.md
+++ b/docs/UAA-Configuration-Reference.md
@@ -185,6 +185,7 @@ or `$CLOUDFOUNDRY_CONFIG_PATH/uaa.yml`.
 | [↪](#scimuserids_enabled) `scim.userids_enabled` | `true`| Enable /ids/Users endpoint|
 | [↪](#scimuseroverride) `scim.user.override` | `false`| Override existing bootstrap users|
 | [↪](#scimdeletedeactivate) `scim.delete.deactivate` | `false`| Deactivate instead of delete|
+| [↪](#sciminviteallow_reinvite) `scim.invite.allow_reinvite` | `true`| Invite verified users for any `scim.invite` caller|
 | [↪](#usermaxcount) `userMaxCount` | `500`| Max users returned by list endpoint|
 | [↪](#groupmaxcount) `groupMaxCount` | `500`| Max groups returned by list endpoint|
 | [↪](#deleteusers) `delete.users` | — (null)| Users to delete on bootstrap|
@@ -1184,6 +1185,16 @@ Bootstrap client definitions loaded at startup. Each entry is keyed by client ID
 - `jwks` — Inline JWKS for private_key_jwt auth
 - `jwks_uri` — URI to fetch JWKS
 - `name` — Display name
+- `signup_redirect_url` — Where a user is sent after confirming a self-service signup and setting a password, when the
+  signup request carries no `redirect_uri` that matches one of the client's registered redirect URIs. Without it the
+  default is the UAA home page.
+- `change_email_redirect_url` — Where a user is sent after verifying an email change, when the verification link
+  carries no `redirect_uri` that matches one of the client's registered redirect URIs. Without it the user is sent to
+  the profile page (or the login page when signed out). `POST /email_changes` returns this value as `redirect_url`.
+
+`signup_redirect_url` and `change_email_redirect_url` are stored as additional information of the client. They are
+keys of the client definition (see `scripts/boot/uaa.yml`) and top-level attributes of the client in the client
+registration API.
 
 [Back to table](#oauth-clients--users)
 
@@ -1848,6 +1859,37 @@ of permanently deleting the record.
 
 ---
 
+### `scim.invite.allow_reinvite`
+
+**Default:** `true`
+**Source:** `@Value("${scim.invite.allow_reinvite:true}")` in [`InvitationsEndpoint`](../server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpoint.java)
+**Type:** `boolean`
+
+Controls what `POST /invite_users` returns for an email address that belongs to a user who is already verified.
+
+- `true` (default): the user is invited like any other user. The response lists the address under `new_invites` with
+  the user's `userId` and a new `inviteLink`.
+- `false`: when the token has `scim.invite` but may not read users, that is when `GET /Users` would refuse it (for
+  example it has neither `scim.read` nor the zone administrator scope), the address is listed under `failed_invites`
+  with the error code `user.already-verified` and the message `The user is already verified.`. No user id and no link
+  are returned, and no invitation code is created. A token that may read users still gets the user id and the link.
+
+With either value, users who are not verified yet and new users are invited as before, so an expired invitation can
+always be sent again, and the other addresses of a batch are processed as usual.
+
+Before setting `false`, check the clients that call `/invite_users`. A client that holds `scim.invite` without
+`scim.read`, re-invites existing users and relies on the user id or the link in the response (for example to assign
+permissions or to send the link itself) receives `failed_invites` for verified users. Give such a client `scim.read`,
+or leave the property at `true`.
+
+Which users are verified: users created with `POST /Users` are verified unless the request says otherwise, users of
+the `uaa` origin become verified when they accept an invitation, and users of an external origin are verified only
+when their identity provider says so (for example the `email_verified` claim of an OpenID Connect provider).
+
+[Back to table](#scim-user-provisioning)
+
+---
+
 ### `userMaxCount`
 
 **Default:** `500`
@@ -1892,6 +1934,26 @@ List of usernames to delete on bootstrap. Used to remove specific users during s
 
 When `true`, "Create Account" and "Forgot Password" links are displayed on the login page.
 
+> **Note on self-service account confirmation.** Clicking the activation link in the confirmation
+> email verifies ownership of the email address but does **not** activate the password typed on the
+> registration form. The owner is sent to a password-setup page (stating that a password change is
+> required due to changes in the system) and must establish their own password through the link
+> before the account can be used to sign in. This ensures a password chosen before the email address
+> was verified can never be used to authenticate. The redirect configured for the registration is
+> applied after the owner has set their password: an explicit `redirect_uri` when it matches one of the
+> client's registered redirect URIs, otherwise the client's `signup_redirect_url`, which does not have
+> to be a registered redirect URI. Opening another activation link for an account that is already
+> confirmed changes nothing: the password stays as it is and the user is sent to the login page.
+>
+> **Note on addresses that already have an account.** The registration form (`/create_account.do`) and
+> the change email form (`/change_email.do`) answer the same way whether or not the address already
+> has a verified account in the zone's `uaa` origin: the user is sent to the "email sent" page, and no
+> `422` response or "There is already a user with that username" message is shown. After a
+> registration the page names the address the email was sent to. When the address already has an
+> account, no activation or verification link is created. The owner of the address instead receives an
+> email stating that the address already has an account and that nothing has changed. Clients that
+> parsed the previous `422` page of these two forms must be updated.
+
 [Back to table](#login--branding)
 
 ---
@@ -3296,6 +3358,13 @@ URL paths instead of different subdomains.
 metadata generation in non-default zones, as the zone information is already encoded in the URL path. See the
 `login.entityBaseURL` documentation for details on how this affects SAML endpoint URLs.
 
+**Required since 2026-10-26:** A zone path request must come from a recognized host, like any other request. The
+hostname must be the host of [`uaa.url`](#uaaurl), the host of [`login.url`](#loginurl), `localhost`, or one of the
+[`zones.internal.hostnames`](#zonesinternalhostnames); otherwise the request is answered with a `404` before it reaches
+the zone. Earlier versions accepted any hostname for a zone path request. Deployments that reach zone paths through a
+hostname that is not yet listed must add it to `zones.internal.hostnames`. When only `localhost` is configured, any
+hostname is accepted.
+
 [Back to table](#zone-paths)
 
 ---
@@ -3308,7 +3377,8 @@ metadata generation in non-default zones, as the zone information is already enc
 
 A comprehensive list of hostnames that route to the UAA default zone. The UAA uses these
 to distinguish zone subdomains. If a request's hostname is not in this list and has extra
-subdomain levels, it is treated as a zone subdomain.
+subdomain levels, it is treated as a zone subdomain. A hostname that matches none of the
+configured root domains is not served, including for zone path requests (`/z/{subdomain}/`) since 2026-10-26.
 
 ```yaml
 zones:
diff --git a/docs/zone-path-feature.md b/docs/zone-path-feature.md
index d15331a40c9..845e79da45d 100644
--- a/docs/zone-path-feature.md
+++ b/docs/zone-path-feature.md
@@ -72,7 +72,11 @@ This is useful in deployments where wildcard DNS or wildcard TLS certificates ar
 
 The refactoring into `resolveZoneBySubdomain()`, `handleZoneNotFound()`, and `doFilterWithZone()` is a readability improvement that also makes each responsibility independently testable.
 
-**Default zone path (`/z/default/`):** `ZonePathContextRewritingFilter` does **not** set `ZONE_SUBDOMAIN_FROM_PATH` for `/z/default/` requests. This means `resolveEffectiveSubdomain()` sees `null` for the path attribute and falls through to hostname-based resolution, which naturally resolves to the default zone. No special-case "default" handling is needed in this filter.
+**Default zone path (`/z/default/`):** `ZonePathContextRewritingFilter` sets
+`ZONE_SUBDOMAIN_FROM_PATH` to the empty string for `/z/default/` requests. This
+explicitly selects the default zone. A tenant hostname combined with
+`/z/default/` is rejected as ambiguous instead of allowing the hostname to
+override the path.
 
 ### 2.2 `OpenIdConnectEndpoints.java`
 
@@ -131,7 +135,13 @@ The outermost filter in the chain (`Ordered.HIGHEST_PRECEDENCE + 1`). For reques
 - **Rewrites the request** by wrapping it in `ZonePathRewrittenRequest` (a private `HttpServletRequestWrapper`) that moves `/z/{subdomain}` from the servlet path into the context path. Downstream code sees `getContextPath()` = `/uaa/z/myzone` and `getServletPath()` = `/login`.
 - **Sets request attributes** `ZONE_SUBDOMAIN_FROM_PATH` (the subdomain string) and `ZONE_ORIGINAL_CONTEXT_PATH` (the pre-rewrite context path like `/uaa`), consumed by `IdentityZoneResolvingFilter` and `ZoneAwareStaticResourceLinkBuilder`.
 - **Wraps the response** in `CookiePathRewritingResponse` which intercepts `addCookie()`, `addHeader("Set-Cookie", ...)`, and `setHeader("Set-Cookie", ...)` to rewrite cookie paths from `/` back to the original context path (e.g., `/uaa`).
-- **Default zone path:** For the subdomain `"default"`, rewrites so the context path **includes** `/z/default` (e.g. `/uaa/z/default`), like any other zone path. Does **not** set `ZONE_SUBDOMAIN_FROM_PATH` so the default zone is resolved. `ZoneContextPathSessionRequestWrapper` maps this context path to the same session key as the root, so `/profile` and `/z/default/profile` share the same cookie/session. See "Default zone path" below.
+- **Default zone path:** For the subdomain `"default"`, rewrites so the context
+  path **includes** `/z/default` (e.g. `/uaa/z/default`), like any other zone
+  path. Sets `ZONE_SUBDOMAIN_FROM_PATH` to the empty string to explicitly select
+  the default zone. `ZoneContextPathSessionRequestWrapper` maps this context
+  path to the same session key as the root, so `/profile` and
+  `/z/default/profile` share the same cookie/session. See "Default zone path"
+  below.
 - **Passes through** non-zone requests unchanged (but still wraps the response for cookie path normalization when a context path is present).
 
 #### Default zone path
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountCreationService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountCreationService.java
index bd790c6812b..6dd06130100 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountCreationService.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountCreationService.java
@@ -1,5 +1,6 @@
 package org.cloudfoundry.identity.uaa.account;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import org.cloudfoundry.identity.uaa.scim.ScimUser;
 
@@ -19,6 +20,8 @@ class AccountCreationResponse {
         private String email;
         @JsonProperty("redirect_location")
         private String redirectLocation;
+        @JsonIgnore
+        private String passwordResetCode;
 
         public AccountCreationResponse(String userId, String username, String email, String redirectLocation) {
             this.userId = userId;
@@ -50,5 +53,13 @@ public String getRedirectLocation() {
         public String getEmail() {
             return email;
         }
+
+        public String getPasswordResetCode() {
+            return passwordResetCode;
+        }
+
+        public void setPasswordResetCode(String passwordResetCode) {
+            this.passwordResetCode = passwordResetCode;
+        }
     }
 }
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java
index 975be8c2494..8b64a654923 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/AccountsController.java
@@ -6,6 +6,7 @@
 import org.cloudfoundry.identity.uaa.provider.IdentityProviderProvisioning;
 import org.cloudfoundry.identity.uaa.scim.exception.InvalidPasswordException;
 import org.cloudfoundry.identity.uaa.util.DomainFilter;
+import org.cloudfoundry.identity.uaa.web.UaaSavedRequestAwareAuthenticationSuccessHandler;
 import org.cloudfoundry.identity.uaa.zone.BrandingInformation;
 import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder;
 import org.springframework.core.env.Environment;
@@ -20,11 +21,14 @@
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.client.HttpClientErrorException;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
 
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.servlet.http.HttpSession;
 import jakarta.validation.Valid;
 import jakarta.validation.constraints.Email;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 import java.util.List;
 
 @Controller
@@ -65,8 +69,11 @@ public String sendActivationEmail(Model model, HttpServletResponse response,
                                       @Valid @ModelAttribute ValidEmail email, BindingResult result,
                                       @RequestParam String password,
                                       @RequestParam("password_confirmation") String passwordConfirmation,
-                                      @RequestParam(value = "does_user_consent", required = false) boolean doesUserConsent) {
+                                      @RequestParam(value = "does_user_consent", required = false) boolean doesUserConsent,
+                                      RedirectAttributes redirectAttributes) {
 
+        model.addAttribute("client_id", clientId);
+        model.addAttribute("redirect_uri", redirectUri);
         BrandingInformation zoneBranding = IdentityZoneHolder.get().getConfig().getBranding();
         if (zoneBranding != null && zoneBranding.getConsent() != null && !doesUserConsent) {
             return handleUnprocessableEntity(model, response, "error_message_code", "missing_consent");
@@ -95,6 +102,7 @@ public String sendActivationEmail(Model model, HttpServletResponse response,
         } catch (InvalidPasswordException e) {
             return handleUnprocessableEntity(model, response, "error_message", e.getMessagesAsOneString());
         }
+        redirectAttributes.addFlashAttribute("email", email.getEmail());
         return "redirect:accounts/email_sent";
     }
 
@@ -124,12 +132,21 @@ public String verifyUser(Model model,
             return "accounts/link_prompt";
         }
 
-        String redirectLocation = accountCreation.getRedirectLocation();
-        String res = "redirect:/login?success=verify_success";
-        if (!redirectLocation.equals(accountCreationService.getDefaultRedirect())) {
-            res += "&form_redirect_uri=" + redirectLocation;
+        if (accountCreation.getPasswordResetCode() == null) {
+            // the password was set by whoever created the account, so there is nothing left to set
+            String redirectLocation = accountCreation.getRedirectLocation();
+            String res = "redirect:/login?success=verify_success";
+            if (!redirectLocation.equals(accountCreationService.getDefaultRedirect())) {
+                UaaSavedRequestAwareAuthenticationSuccessHandler.saveTrustedRedirect(session, redirectLocation);
+                res += "&form_redirect_uri=" + URLEncoder.encode(redirectLocation, StandardCharsets.UTF_8);
+            }
+            return res;
         }
-        return res;
+
+        // Confirmation establishes email ownership but leaves the account without a usable
+        // password. Send the owner to the reset-password page to set their own password; any
+        // client redirect is carried by the reset code and applied once the password is set.
+        return "redirect:/reset_password?code=" + accountCreation.getPasswordResetCode() + "&force_change=true";
     }
 
     private String handleUnprocessableEntity(Model model, HttpServletResponse response, String attributeKey, String attributeValue) {
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java
index e00a7abe32f..601c6a8ad27 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ChangeEmailController.java
@@ -7,6 +7,7 @@
 import org.cloudfoundry.identity.uaa.error.UaaException;
 import org.cloudfoundry.identity.uaa.user.UaaUser;
 import org.cloudfoundry.identity.uaa.user.UaaUserDatabase;
+import org.cloudfoundry.identity.uaa.web.UaaSavedRequestAwareAuthenticationSuccessHandler;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.authentication.AnonymousAuthenticationToken;
 import org.springframework.security.core.context.SecurityContext;
@@ -25,6 +26,8 @@
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.validation.Valid;
 import jakarta.validation.constraints.Email;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 import java.util.Map;
 
 @Controller
@@ -56,6 +59,8 @@ public String changeEmail(Model model, @Valid @ModelAttribute ValidEmail newEmai
             @RequestParam(required = false, value = "redirect_uri") String redirectUri,
             RedirectAttributes redirectAttributes, HttpServletResponse response) {
         SecurityContext securityContext = SecurityContextHolder.getContext();
+        model.addAttribute("client_id", clientId);
+        model.addAttribute("redirect_uri", redirectUri);
 
         if (result.hasErrors()) {
             model.addAttribute("error_message_code", "invalid_email");
@@ -72,16 +77,7 @@ public String changeEmail(Model model, @Valid @ModelAttribute ValidEmail newEmai
         String userId = ((UaaPrincipal) securityContext.getAuthentication().getPrincipal()).getId();
         String userEmail = ((UaaPrincipal) securityContext.getAuthentication().getPrincipal()).getName();
 
-        try {
-            changeEmailService.beginEmailChange(userId, userEmail, newEmail.getNewEmail(), clientId, redirectUri);
-        } catch (UaaException e) {
-            if (e.getHttpStatus() == 409) {
-                model.addAttribute("error_message_code", "username_exists");
-                model.addAttribute("email", ((UaaPrincipal) securityContext.getAuthentication().getPrincipal()).getEmail());
-                response.setStatus(HttpStatus.UNPROCESSABLE_ENTITY.value());
-                return "change_email";
-            }
-        }
+        changeEmailService.beginEmailChange(userId, userEmail, newEmail.getNewEmail(), clientId, redirectUri);
 
         return "redirect:email_sent?code=email_change";
     }
@@ -125,7 +121,10 @@ public String verifyEmail(Model model, @RequestParam String code, RedirectAttrib
             if (redirectLocation == null) {
                 return "redirect:login?success=change_email_success";
             } else {
-                return "redirect:login?success=change_email_success&form_redirect_uri=" + redirectLocation;
+                UaaSavedRequestAwareAuthenticationSuccessHandler.saveTrustedRedirect(
+                        request.getSession(),
+                        redirectLocation);
+                return "redirect:login?success=change_email_success&form_redirect_uri=" + URLEncoder.encode(redirectLocation, StandardCharsets.UTF_8);
             }
         }
     }
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java
index fab9727183c..e9b75de15e2 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailAccountCreationService.java
@@ -14,6 +14,7 @@
 import org.cloudfoundry.identity.uaa.scim.exception.ScimResourceAlreadyExistsException;
 import org.cloudfoundry.identity.uaa.scim.util.ScimUtils;
 import org.cloudfoundry.identity.uaa.scim.validate.PasswordValidator;
+import org.cloudfoundry.identity.uaa.util.AlphanumericRandomValueStringGenerator;
 import org.cloudfoundry.identity.uaa.util.JsonUtils;
 import org.cloudfoundry.identity.uaa.zone.IdentityZone;
 import org.cloudfoundry.identity.uaa.zone.MergedZoneBrandingInformation;
@@ -22,7 +23,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Qualifier;
-import org.springframework.http.HttpStatus;
+import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.stereotype.Service;
 import org.springframework.util.StringUtils;
 import org.springframework.web.client.HttpClientErrorException;
@@ -52,6 +53,7 @@ public class EmailAccountCreationService implements AccountCreationService {
     private final ScimUserProvisioning scimUserProvisioning;
     private final MultitenantClientServices clientDetailsService;
     private final PasswordValidator passwordValidator;
+    private final ResetPasswordService resetPasswordService;
     private final IdentityZoneManager identityZoneManager;
 
     public EmailAccountCreationService(
@@ -61,6 +63,7 @@ public EmailAccountCreationService(
             ScimUserProvisioning scimUserProvisioning,
             MultitenantClientServices clientDetailsService,
             PasswordValidator passwordValidator,
+            ResetPasswordService resetPasswordService,
             IdentityZoneManager identityZoneManager) {
 
         this.templateEngine = templateEngine;
@@ -69,6 +72,7 @@ public EmailAccountCreationService(
         this.scimUserProvisioning = scimUserProvisioning;
         this.clientDetailsService = clientDetailsService;
         this.passwordValidator = passwordValidator;
+        this.resetPasswordService = resetPasswordService;
         this.identityZoneManager = identityZoneManager;
     }
 
@@ -84,7 +88,7 @@ public void beginActivation(String email, String password, String clientId, Stri
             List<ScimUser> users = scimUserProvisioning.retrieveByUsernameAndOriginAndZone(email, OriginKeys.UAA, identityZoneManager.getCurrentIdentityZoneId());
             if (!users.isEmpty()) {
                 if (users.getFirst().isVerified()) {
-                    throw new UaaException("User already active.", HttpStatus.CONFLICT.value());
+                    messageService.sendMessage(email, MessageType.CREATE_ACCOUNT_CONFIRMATION, buildAccountExistsSubjectText(), getAccountExistsEmailHtml(email));
                 } else {
                     generateAndSendCode(email, clientId, subject, users.getFirst().getId(), redirectUri, identityZoneManager.getCurrentIdentityZone());
                 }
@@ -121,14 +125,57 @@ public AccountCreationResponse completeActivation(String code) {
 
         Map<String, String> data = JsonUtils.readValue(expiringCode.getData(), new TypeReference<Map<String, String>>() {
         });
-        ScimUser user = scimUserProvisioning.retrieve(data.get("user_id"), identityZoneManager.getCurrentIdentityZoneId());
-        user = scimUserProvisioning.verifyUser(user.getId(), user.getVersion(), identityZoneManager.getCurrentIdentityZoneId());
+        String zoneId = identityZoneManager.getCurrentIdentityZoneId();
+        ScimUser user = scimUserProvisioning.retrieve(data.get("user_id"), zoneId);
 
         String clientId = data.get("client_id");
         String redirectUri = data.get("redirect_uri") != null ? data.get("redirect_uri") : "";
+
+        if (user.isVerified()) {
+            // The account is already verified, for example through another activation link. Leave its password
+            // alone: the owner has set it, or can set it through forgot password.
+            return new AccountCreationResponse(user.getId(), user.getUserName(), user.getUserName(), getRedirect(clientId, redirectUri));
+        }
+
+        if (Boolean.parseBoolean(data.get(ScimUtils.USER_PROVISIONED)) || !OriginKeys.UAA.equals(user.getOrigin())) {
+            // The code was requested through the user API, so a caller that may create users set the password.
+            // Opening the link only has to verify the email address. The same goes for a user of another origin,
+            // whose password is not managed here: the reset code below is looked up by username in the uaa origin,
+            // so it could belong to a different account.
+            user = scimUserProvisioning.verifyUser(user.getId(), user.getVersion(), zoneId);
+            return new AccountCreationResponse(user.getId(), user.getUserName(), user.getUserName(), getRedirect(clientId, redirectUri));
+        }
+
+        // Confirming the activation link proves ownership of the email address, but it does not
+        // prove that the person confirming is the one who chose the password on the registration
+        // form. Atomically discard that password, require a change, and verify the account. The
+        // conditional update also ensures that only one of several concurrent activation links can
+        // claim the account; a losing request must not overwrite a password the owner has since set.
+        try {
+            user = scimUserProvisioning.verifyUserAndSetPassword(
+                    user.getId(),
+                    new AlphanumericRandomValueStringGenerator(40).generate(),
+                    true,
+                    zoneId);
+        } catch (OptimisticLockingFailureException e) {
+            user = scimUserProvisioning.retrieve(data.get("user_id"), zoneId);
+            if (!user.isVerified()) {
+                throw e;
+            }
+            return new AccountCreationResponse(user.getId(), user.getUserName(), user.getUserName(), getRedirect(clientId, redirectUri));
+        }
+
+        // Resolve the signup redirect (honouring the client's signup_redirect_url fallback) so it is
+        // preserved across the reset flow and applied once the owner has set their password.
         String redirectLocation = getRedirect(clientId, redirectUri);
 
-        return new AccountCreationResponse(user.getId(), user.getUserName(), user.getUserName(), redirectLocation);
+        // Issue an ownership-bound, single-use code so the owner sets their password through the
+        // same reset flow used for password recovery (no previous password is required).
+        ForgotPasswordInfo forgotPasswordInfo = resetPasswordService.forgotPassword(user.getUserName(), clientId, redirectLocation);
+
+        AccountCreationResponse response = new AccountCreationResponse(user.getId(), user.getUserName(), user.getUserName(), redirectLocation);
+        response.setPasswordResetCode(forgotPasswordInfo.getResetPasswordCode().getCode());
+        return response;
     }
 
     private String getRedirect(String clientId, String redirectUri) {
@@ -188,6 +235,23 @@ private String buildSubjectText() {
         }
     }
 
+    private String buildAccountExistsSubjectText() {
+        return "You already have an account";
+    }
+
+    private String getAccountExistsEmailHtml(String email) {
+        IdentityZone currentIdentityZone = identityZoneManager.getCurrentIdentityZone();
+        final Context ctx = new Context();
+        String companyName = MergedZoneBrandingInformation.resolveBranding().getCompanyName();
+        if (currentIdentityZone.isUaa()) {
+            ctx.setVariable("serviceName", StringUtils.hasText(companyName) ? companyName : "Cloud Foundry");
+        } else {
+            ctx.setVariable("serviceName", currentIdentityZone.getName());
+        }
+        ctx.setVariable("email", email);
+        return templateEngine.process("account_exists", ctx);
+    }
+
     private String getEmailHtml(String code, String email, IdentityZone currentIdentityZone) {
         String accountsUrl = ScimUtils.getVerificationURL(null, currentIdentityZone).toString();
 
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailService.java
index d6967aa20e7..11e6afd99b4 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailService.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailService.java
@@ -69,7 +69,8 @@ public void beginEmailChange(String userId, String email, String newEmail, Strin
 
         if (user.getUserName().equals(user.getPrimaryEmail())) {
             if (!results.isEmpty()) {
-                throw new UaaException("Conflict", 409);
+                messageService.sendMessage(newEmail, MessageType.CHANGE_EMAIL, "You already have an account", getAccountExistsEmailHtml(newEmail));
+                return;
             }
         }
 
@@ -127,7 +128,9 @@ public Map<String, String> completeVerification(String code) {
                 Set<String> redirectUris = clientDetails.getRegisteredRedirectUri() == null ? Collections.emptySet() :
                         clientDetails.getRegisteredRedirectUri();
                 String changeEmailRedirectUrl = (String) clientDetails.getAdditionalInformation().get(CHANGE_EMAIL_REDIRECT_URL);
-                redirectLocation = findMatchingRedirectUri(redirectUris, redirectUri, changeEmailRedirectUrl);
+                // without a configured fallback, only a requested URI that matches a registered one is used
+                String matchingRedirectUri = findMatchingRedirectUri(redirectUris, redirectUri, changeEmailRedirectUrl != null ? changeEmailRedirectUrl : "");
+                redirectLocation = StringUtils.hasText(matchingRedirectUri) ? matchingRedirectUri : null;
             } catch (NoSuchClientException _) {
                 // ignore
             }
@@ -150,6 +153,18 @@ private String getSubjectText() {
         }
     }
 
+    private String getAccountExistsEmailHtml(String newEmail) {
+        final Context ctx = new Context();
+        if (identityZoneManager.isCurrentZoneUaa()) {
+            String companyName = MergedZoneBrandingInformation.resolveBranding().getCompanyName();
+            ctx.setVariable("serviceName", StringUtils.hasText(companyName) ? companyName : "Cloud Foundry");
+        } else {
+            ctx.setVariable("serviceName", identityZoneManager.getCurrentIdentityZone().getName());
+        }
+        ctx.setVariable("email", newEmail);
+        return templateEngine.process("account_exists", ctx);
+    }
+
     private String getEmailChangeEmailHtml(String email, String newEmail, String code) {
         String verifyUrl = UaaUrlUtils.getUaaUrl("/verify_email", identityZoneManager.getCurrentIdentityZone());
 
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java
index 47084790f4d..93d7772fdf4 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilter.java
@@ -19,10 +19,12 @@
 import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore;
 import org.cloudfoundry.identity.uaa.error.UaaException;
 import org.cloudfoundry.identity.uaa.scim.exception.InvalidPasswordException;
+import org.cloudfoundry.identity.uaa.web.UaaSavedRequestAwareAuthenticationSuccessHandler;
 import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.InternalAuthenticationServiceException;
+import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
@@ -34,13 +36,15 @@
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
-import java.sql.Timestamp;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 
 public class ResetPasswordAuthenticationFilter extends OncePerRequestFilter {
     private final ResetPasswordService service;
     private final AuthenticationEntryPoint entryPoint;
     private final ExpiringCodeStore expiringCodeStore;
     public static final String RESET_PASSWORD_URL = "/reset_password.do";
+    private static final String INVALID_CODE_MESSAGE = "Sorry, your reset password link is no longer valid. Please request a new one";
     private static final RequestMatcher matcher = PathPatternRequestMatcher.withDefaults().matcher(HttpMethod.POST, RESET_PASSWORD_URL);
 
     public ResetPasswordAuthenticationFilter(
@@ -75,33 +79,40 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
             expiringCode = expiringCodeStore.retrieveCode(code, IdentityZoneHolder.get().getId());
             validation.throwIfNotValid();
             if (expiringCode == null) {
-                throw new InvalidCodeException("invalid_code", "Sorry, your reset password link is no longer valid. Please request a new one", 422);
+                throw new InvalidCodeException("invalid_code", INVALID_CODE_MESSAGE, 422);
             }
             ResetPasswordService.ResetPasswordResponse resetPasswordResponse = service.resetPassword(expiringCode, password);
             String redirectUri = resetPasswordResponse.getRedirectUri();
             if (!StringUtils.hasText(redirectUri) || "home".equals(redirectUri)) {
                 response.sendRedirect(request.getContextPath() + "/login?success=password_reset");
             } else {
-                response.sendRedirect(request.getContextPath() + "/login?success=password_reset&form_redirect_uri=" + redirectUri);
+                UaaSavedRequestAwareAuthenticationSuccessHandler.saveTrustedRedirect(
+                        request.getSession(),
+                        redirectUri);
+                response.sendRedirect(request.getContextPath() + "/login?success=password_reset&form_redirect_uri=" + URLEncoder.encode(redirectUri, StandardCharsets.UTF_8));
             }
         } catch (InvalidPasswordException e) {
-            if (expiringCode != null) {
-                refreshCode(request, expiringCode);
-            }
-            entryPoint.commence(request, response, new BadCredentialsException(e.getMessagesAsOneString(), e));
+            commenceWithRefreshedCode(request, response, expiringCode, new BadCredentialsException(e.getMessagesAsOneString(), e));
         } catch (UaaException e) {
             entryPoint.commence(request, response, new InternalAuthenticationServiceException(e.getMessage(), e));
         } catch (PasswordConfirmationException pe) {
-            if (expiringCode != null) {
-                refreshCode(request, expiringCode);
-            }
-            entryPoint.commence(request, response, new BadCredentialsException("Password did not pass validation.", pe));
+            commenceWithRefreshedCode(request, response, expiringCode, new BadCredentialsException("Password did not pass validation.", pe));
         }
     }
 
-    private void refreshCode(HttpServletRequest request, ExpiringCode expiringCode) {
-        ExpiringCode newCode = expiringCodeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + 1000 * 60 * 10), expiringCode.getIntent(), IdentityZoneHolder.get().getId());
-        request.setAttribute("code", newCode.getCode());
+    private void commenceWithRefreshedCode(HttpServletRequest request, HttpServletResponse response, ExpiringCode expiringCode, AuthenticationException failure) throws IOException, ServletException {
+        if (expiringCode != null) {
+            try {
+                ExpiringCode newCode = expiringCodeStore.generateCode(expiringCode.getData(), expiringCode.getExpiresAt(), expiringCode.getIntent(), IdentityZoneHolder.get().getId());
+                request.setAttribute("code", newCode.getCode());
+            } catch (IllegalArgumentException _) {
+                // the code expired while the password was checked, so there is no code left to submit again
+                InvalidCodeException expired = new InvalidCodeException("invalid_code", INVALID_CODE_MESSAGE, 422);
+                entryPoint.commence(request, response, new InternalAuthenticationServiceException(expired.getMessage(), expired));
+                return;
+            }
+        }
+        entryPoint.commence(request, response, failure);
     }
 
 }
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordController.java
index b10f38d66b7..6a6ed112844 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordController.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/ResetPasswordController.java
@@ -35,7 +35,6 @@
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.servlet.http.HttpSession;
-import java.sql.Timestamp;
 import java.util.Map;
 
 import static org.cloudfoundry.identity.uaa.account.UaaResetPasswordService.FORGOT_PASSWORD_INTENT_PREFIX;
@@ -176,19 +175,22 @@ public void resetPassword() {
     @GetMapping(value = "/reset_password", params = {"code"})
     public String resetPasswordPage(Model model,
             HttpServletResponse response,
-            @RequestParam("code") String code) {
+            @RequestParam("code") String code,
+            @RequestParam(value = "force_change", required = false) boolean forceChange) {
 
-        ExpiringCode expiringCode = checkIfUserExists(codeStore.retrieveCode(code, identityZoneManager.getCurrentIdentityZone().getId()));
+        ExpiringCode expiringCode = checkIfUserExists(codeStore.peekCode(code, identityZoneManager.getCurrentIdentityZone().getId()));
         if (expiringCode == null) {
             return handleUnprocessableEntity(model, response, "message_code", "bad_code");
         } else {
             PasswordChange passwordChange = JsonUtils.readValue(expiringCode.getData(), PasswordChange.class);
             String userId = passwordChange.getUserId();
             UaaUser uaaUser = userDatabase.retrieveUserById(userId);
-            String newCode = codeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + (10 * 60 * 1000)), expiringCode.getIntent(), identityZoneManager.getCurrentIdentityZoneId()).getCode();
-            model.addAttribute("code", newCode);
+            model.addAttribute("code", expiringCode.getCode());
             model.addAttribute("email", uaaUser.getEmail());
             model.addAttribute("username", uaaUser.getUsername());
+            if (forceChange) {
+                model.addAttribute("message_code", "force_change");
+            }
             return "reset_password";
         }
     }
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/account/UaaResetPasswordService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/account/UaaResetPasswordService.java
index a7c51da5b32..42ae880822e 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/account/UaaResetPasswordService.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/account/UaaResetPasswordService.java
@@ -135,9 +135,14 @@ private ResetPasswordResponse changePasswordCodeAuthenticated(ExpiringCode expir
                     ClientDetails clientDetails = clientDetailsService.loadClientByClientId(clientId, identityZoneManager.getCurrentIdentityZoneId());
                     Set<String> redirectUris = clientDetails.getRegisteredRedirectUri() == null ? Collections.emptySet() :
                             clientDetails.getRegisteredRedirectUri();
-                    String matchingRedirectUri = UaaUrlUtils.findMatchingRedirectUri(redirectUris, redirectUri, redirectLocation);
-                    if (matchingRedirectUri != null) {
-                        redirectLocation = matchingRedirectUri;
+                    if (redirectUri.equals(clientDetails.getAdditionalInformation().get(EmailAccountCreationService.SIGNUP_REDIRECT_URL))) {
+                        // an administrator set it on the client, so it does not have to be a registered redirect URI
+                        redirectLocation = redirectUri;
+                    } else {
+                        String matchingRedirectUri = UaaUrlUtils.findMatchingRedirectUri(redirectUris, redirectUri, redirectLocation);
+                        if (matchingRedirectUri != null) {
+                            redirectLocation = matchingRedirectUri;
+                        }
                     }
                 } catch (NoSuchClientException _) {
                     // ignore
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilter.java
index f727afd43d4..52177fb46d6 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilter.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilter.java
@@ -16,6 +16,7 @@
 
 import org.cloudfoundry.identity.uaa.codestore.ExpiringCode;
 import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore;
+import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType;
 import org.cloudfoundry.identity.uaa.constants.OriginKeys;
 import org.cloudfoundry.identity.uaa.oauth.provider.OAuth2RequestFactory;
 import org.cloudfoundry.identity.uaa.passcode.PasscodeInformation;
@@ -194,7 +195,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
                     }
                 }
 
-                if (pi == null) {
+                if (pi == null || !(ExpiringCodeType.PASSCODE + " " + pi.getUserId()).equals(eCode.getIntent())) {
                     throw new InsufficientAuthenticationException("Invalid passcode");
                 }
                 logger.debug("Successful passcode authentication request for {}", pi.getUsername());
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilter.java
index e177ac49f35..02bbe40ead4 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilter.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilter.java
@@ -9,6 +9,7 @@
 import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
 
 import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.springframework.security.web.util.matcher.RequestMatchers;
 import org.springframework.web.filter.OncePerRequestFilter;
 
 import jakarta.servlet.FilterChain;
@@ -33,7 +34,9 @@ public PasswordChangeUiRequiredFilter() {
 
     public PasswordChangeUiRequiredFilter(UaaSavedRequestCache cache) {
         this.cache = cache;
-        this.matchPath = PathPatternRequestMatcher.withDefaults().matcher(MATCH_PATH);
+        this.matchPath = RequestMatchers.anyOf(
+                PathPatternRequestMatcher.withDefaults().matcher(MATCH_PATH),
+                PathPatternRequestMatcher.withDefaults().matcher(MATCH_PATH + "/"));
         this.completedPath = PathPatternRequestMatcher.withDefaults().matcher(COMPLETED_PATH);
     }
 
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpoints.java b/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpoints.java
index f9b47ac1524..a7b1962b50a 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpoints.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpoints.java
@@ -13,9 +13,16 @@
 
 import jakarta.servlet.http.HttpServletRequest;
 
+import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.EMAIL;
+import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.INVITATION;
+import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.REGISTRATION;
+
 @Controller
 public class CodeStoreEndpoints {
 
+    private static final String INTENT_REQUIRED_MESSAGE = "intent is required. Known intents: "
+            + String.join(", ", EMAIL.name(), INVITATION.name(), REGISTRATION.name()) + "; custom values are accepted.";
+
     private final ExpiringCodeStore expiringCodeStore;
     private final HttpMessageConverter<?>[] messageConverters;
     private final IdentityZoneManager identityZoneManager;
@@ -32,9 +39,13 @@ public class CodeStoreEndpoints {
     @PostMapping({"/Codes", "/Codes/"})
     @ResponseStatus(HttpStatus.CREATED)
     @ResponseBody
-    public ExpiringCode generateCode(@RequestBody ExpiringCode expiringCode) {
+    public ExpiringCode generateCode(@RequestBody(required = false) ExpiringCode expiringCode) {
+        String intent = expiringCode == null ? null : expiringCode.getIntent();
+        if (intent == null || intent.isBlank()) {
+            throw new CodeStoreException(INTENT_REQUIRED_MESSAGE, HttpStatus.BAD_REQUEST);
+        }
         try {
-            return expiringCodeStore.generateCode(expiringCode.getData(), expiringCode.getExpiresAt(), null, identityZoneManager.getCurrentIdentityZoneId());
+            return expiringCodeStore.generateCode(expiringCode.getData(), expiringCode.getExpiresAt(), intent, identityZoneManager.getCurrentIdentityZoneId());
         } catch (NullPointerException _) {
             throw new CodeStoreException("data and expiresAt are required.", HttpStatus.BAD_REQUEST);
         } catch (IllegalArgumentException _) {
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/JdbcExpiringCodeStore.java b/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/JdbcExpiringCodeStore.java
index 040fc8a1b9b..7975538f345 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/JdbcExpiringCodeStore.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/codestore/JdbcExpiringCodeStore.java
@@ -154,6 +154,10 @@ public ExpiringCode retrieveCode(String code, String zoneId) {
             if (expiringCode != null && expiringCode.getExpiresAt().getTime() < timeService.getCurrentTimeMillis()) {
                 expiringCode = null;
             }
+            if (expiringCode != null && expiringCode.getIntent() == null) {
+                // codes stored without an intent predate required intents; each is redeemed once, so this logs at most once per code
+                logger.debug("Redeemed an expiring code stored without an intent, zoneId={}", zoneId);
+            }
             return expiringCode;
         } catch (EmptyResultDataAccessException _) {
             return null;
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsService.java b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsService.java
index 8b8c594d1e0..7eb5b874454 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsService.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsService.java
@@ -14,6 +14,7 @@
 import org.slf4j.LoggerFactory;
 import org.springframework.http.HttpStatus;
 import org.cloudfoundry.identity.uaa.oauth.provider.ClientDetails;
+import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.stereotype.Service;
 import org.springframework.util.StringUtils;
 import org.springframework.web.client.HttpClientErrorException;
@@ -65,14 +66,24 @@ public AcceptedInvitation acceptInvitation(String code, String password) {
 
         ScimUser user = scimUserProvisioning.retrieve(userId, identityZoneManager.getCurrentIdentityZoneId());
 
-        if (UAA.equals(user.getOrigin())) {
-            user = scimUserProvisioning.verifyUser(userId, user.getVersion(), identityZoneManager.getCurrentIdentityZoneId());
-
-            // Only reset the password for newly created users
+        if (UAA.equals(user.getOrigin()) && !user.isVerified()) {
             boolean createdNewUser = Boolean.parseBoolean(
                     userData.getOrDefault(CREATED_NEW_USER, "true")); // default true for in-flight codes
             if (StringUtils.hasText(password) && createdNewUser) {
-                scimUserProvisioning.changePassword(userId, null, password, identityZoneManager.getCurrentIdentityZoneId());
+                try {
+                    user = scimUserProvisioning.verifyUserAndSetPassword(
+                            userId,
+                            password,
+                            false,
+                            identityZoneManager.getCurrentIdentityZoneId());
+                } catch (OptimisticLockingFailureException e) {
+                    user = scimUserProvisioning.retrieve(userId, identityZoneManager.getCurrentIdentityZoneId());
+                    if (!user.isVerified()) {
+                        throw e;
+                    }
+                }
+            } else {
+                user = scimUserProvisioning.verifyUser(userId, user.getVersion(), identityZoneManager.getCurrentIdentityZoneId());
             }
         }
 
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java
index e17d5bbb956..8a04044ba07 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsController.java
@@ -22,6 +22,7 @@
 import org.cloudfoundry.identity.uaa.scim.ScimUser;
 import org.cloudfoundry.identity.uaa.scim.ScimUserProvisioning;
 import org.cloudfoundry.identity.uaa.scim.exception.InvalidPasswordException;
+import org.cloudfoundry.identity.uaa.scim.exception.ScimResourceNotFoundException;
 import org.cloudfoundry.identity.uaa.scim.validate.PasswordValidator;
 import org.cloudfoundry.identity.uaa.user.UaaAuthority;
 import org.cloudfoundry.identity.uaa.user.UaaUser;
@@ -29,6 +30,7 @@
 import org.cloudfoundry.identity.uaa.util.JsonUtils;
 import org.cloudfoundry.identity.uaa.util.ObjectUtils;
 import org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils;
+import org.cloudfoundry.identity.uaa.web.UaaSavedRequestAwareAuthenticationSuccessHandler;
 import org.cloudfoundry.identity.uaa.zone.BrandingInformation;
 import org.cloudfoundry.identity.uaa.zone.beans.IdentityZoneManager;
 import org.springframework.beans.factory.annotation.Qualifier;
@@ -61,6 +63,7 @@
 import java.util.Enumeration;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Objects;
 
 import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.INVITATION;
 import static org.cloudfoundry.identity.uaa.constants.OriginKeys.OAUTH20;
@@ -134,14 +137,18 @@ public String acceptInvitePage(@RequestParam String code, Model model, HttpServl
             boolean isUaaUserAndVerified =
                     UAA.equals(provider.getType()) && user.isVerified();
             boolean isExternalUserAndAcceptedInvite =
-                    !UAA.equals(provider.getType()) && UaaHttpRequestUtils.isAcceptedInvitationAuthentication();
+                    !UAA.equals(provider.getType())
+                            && UaaHttpRequestUtils.isAcceptedInvitationAuthentication()
+                            && Objects.equals(codeData.get("user_id"), UaaHttpRequestUtils.getInvitedUserId())
+                            && Objects.equals(origin, UaaHttpRequestUtils.getInvitationOrigin());
             if (isUaaUserAndVerified || isExternalUserAndAcceptedInvite) {
                 AcceptedInvitation accepted = invitationsService.acceptInvitation(code, "");
+                UaaHttpRequestUtils.clearInvitationSessionAttributes();
                 String redirect = "redirect:" + accepted.getRedirectUri();
                 log.debug("Redirecting accepted invitation for email:%s, id:%s to URL:%s".formatted(codeData.get(EMAIL), codeData.get("user_id"), redirect));
                 return redirect;
             } else if (SAML.equals(provider.getType())) {
-                setRequestAttributes(request, code, user);
+                setRequestAttributes(request, code, user, origin);
 
                 SamlIdentityProviderDefinition definition = ObjectUtils.castInstance(provider.getConfig(), SamlIdentityProviderDefinition.class);
 
@@ -149,7 +156,7 @@ public String acceptInvitePage(@RequestParam String code, Model model, HttpServl
                 log.debug("Redirecting invitation for email:%s, id:%s single SAML IDP URL:%s".formatted(codeData.get(EMAIL), codeData.get("user_id"), redirect));
                 return redirect;
             } else if (OIDC10.equals(provider.getType()) || OAUTH20.equals(provider.getType())) {
-                setRequestAttributes(request, code, user);
+                setRequestAttributes(request, code, user, origin);
 
                 AbstractExternalOAuthIdentityProviderDefinition definition = ObjectUtils.castInstance(provider.getConfig(), AbstractExternalOAuthIdentityProviderDefinition.class);
 
@@ -190,9 +197,8 @@ private void transferErrorParameters(Model model, HttpServletRequest request) {
         }
     }
 
-    private void setRequestAttributes(HttpServletRequest request, String newCode, UaaUser user) {
-        RequestContextHolder.getRequestAttributes().setAttribute("IS_INVITE_ACCEPTANCE", true, RequestAttributes.SCOPE_SESSION);
-        RequestContextHolder.getRequestAttributes().setAttribute("user_id", user.getId(), RequestAttributes.SCOPE_SESSION);
+    private void setRequestAttributes(HttpServletRequest request, String newCode, UaaUser user, String origin) {
+        UaaHttpRequestUtils.setInvitationSessionAttributes(user.getId(), origin);
         HttpServletRequestWrapper wrapper = getNewCodeWrapper(request, newCode);
 
         SavedRequest savedRequest = new DefaultSavedRequest(wrapper);
@@ -245,6 +251,7 @@ public String acceptInvitation(@RequestParam("password") String password,
             @RequestParam(value = "does_user_consent", required = false) boolean doesUserConsent,
             Model model,
             RedirectAttributes redirectAttributes,
+            HttpServletRequest request,
             HttpServletResponse response) {
 
         PasswordConfirmationValidation validation = new PasswordConfirmationValidation(password, passwordConfirmation);
@@ -253,8 +260,10 @@ public String acceptInvitation(@RequestParam("password") String password,
 
         final ExpiringCode expiringCode = expiringCodeStore.retrieveCode(code, identityZoneManager.getCurrentIdentityZoneId());
 
-        if (expiringCode == null || expiringCode.getData() == null) {
-            log.debug("Failing invitation. Code not found.");
+        if (expiringCode == null
+                || expiringCode.getData() == null
+                || (expiringCode.getIntent() != null && !INVITATION.name().equals(expiringCode.getIntent()))) {
+            log.debug("Failing invitation. Code not found or intent is invalid.");
             SecurityContextHolder.clearContext();
             return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_invite");
         }
@@ -285,9 +294,13 @@ public String acceptInvitation(@RequestParam("password") String password,
         } catch (HttpClientErrorException _) {
             return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_invite");
         }
+        UaaHttpRequestUtils.clearInvitationSessionAttributes();
         String res = "redirect:/login?success=invite_accepted";
         if (!invitation.getRedirectUri().equals("/home")) {
-            res += "&" + FORM_REDIRECT_PARAMETER + "=" + invitation.getRedirectUri();
+            UaaSavedRequestAwareAuthenticationSuccessHandler.saveTrustedRedirect(
+                    request.getSession(),
+                    invitation.getRedirectUri());
+            res += "&" + FORM_REDIRECT_PARAMETER + "=" + URLEncoder.encode(invitation.getRedirectUri(), StandardCharsets.UTF_8);
         }
         return res;
     }
@@ -314,14 +327,31 @@ public String acceptLdapInvitation(@RequestParam("enterprise_username") String u
             @RequestParam("enterprise_password") String password,
             @RequestParam("enterprise_email") String email,
             @RequestParam String code,
-            Model model, HttpServletResponse response) {
+            Model model, HttpServletRequest request, HttpServletResponse response) {
 
         ExpiringCode expiringCode = expiringCodeStore.retrieveCode(code, identityZoneManager.getCurrentIdentityZoneId());
-        if (expiringCode == null) {
-            return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_enterprise.do");
+        if (expiringCode == null
+                || (expiringCode.getIntent() != null && !INVITATION.name().equals(expiringCode.getIntent()))) {
+            return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_invite");
+        }
+
+        Map<String, String> data = JsonUtils.readValue(expiringCode.getData(), new TypeReference<>() {
+        });
+        if (!OriginKeys.LDAP.equals(data.get(ORIGIN))) {
+            return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_invite");
+        }
+
+        ScimUser user;
+        try {
+            user = userProvisioning.retrieve(data.get("user_id"), identityZoneManager.getCurrentIdentityZoneId());
+        } catch (ScimResourceNotFoundException _) {
+            return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_invite");
+        }
+        if (!OriginKeys.LDAP.equals(user.getOrigin())) {
+            return handleUnprocessableEntity(model, response, "error_message_code", "code_expired", "invitations/accept_invite");
         }
 
-        String newCode = expiringCodeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + (1000 * 60 * 10)), null, identityZoneManager.getCurrentIdentityZoneId()).getCode();
+        String newCode = expiringCodeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + (1000 * 60 * 10)), expiringCode.getIntent(), identityZoneManager.getCurrentIdentityZoneId()).getCode();
 
         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password);
         AuthenticationManager authenticationManager;
@@ -340,13 +370,10 @@ public String acceptLdapInvitation(@RequestParam("enterprise_username") String u
         Authentication authentication;
         try {
             authentication = authenticationManager.authenticate(token);
-            Map<String, String> data = JsonUtils.readValue(expiringCode.getData(), new TypeReference<>() {
-            });
-            ScimUser user = userProvisioning.retrieve(data.get("user_id"), identityZoneManager.getCurrentIdentityZoneId());
             if (!user.getPrimaryEmail().equalsIgnoreCase(((ExtendedLdapUserDetails) authentication.getPrincipal()).getEmailAddress())) {
                 model.addAttribute(EMAIL, data.get(EMAIL));
                 model.addAttribute("provider", OriginKeys.LDAP);
-                model.addAttribute("code", expiringCodeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + (10 * 60 * 1000)), null, identityZoneManager.getCurrentIdentityZoneId()).getCode());
+                model.addAttribute("code", expiringCodeStore.generateCode(expiringCode.getData(), new Timestamp(System.currentTimeMillis() + (10 * 60 * 1000)), expiringCode.getIntent(), identityZoneManager.getCurrentIdentityZoneId()).getCode());
                 return handleUnprocessableEntity(model, response, "error_message", "invite.email_mismatch", "invitations/accept_invite");
             }
 
@@ -356,6 +383,10 @@ public String acceptLdapInvitation(@RequestParam("enterprise_username") String u
                 userProvisioning.update(user.getId(), user, identityZoneManager.getCurrentIdentityZoneId());
                 zoneAwareAuthenticationManager.getLdapAuthenticationManager(identityZoneManager.getCurrentIdentityZone(), ldapProvider).authenticate(token);
                 AcceptedInvitation accept = invitationsService.acceptInvitation(newCode, "");
+                UaaHttpRequestUtils.clearInvitationSessionAttributes();
+                UaaSavedRequestAwareAuthenticationSuccessHandler.saveTrustedRedirect(
+                        request.getSession(),
+                        accept.getRedirectUri());
                 return "redirect:" + "/login?success=invite_accepted&form_redirect_uri=" + URLEncoder.encode(accept.getRedirectUri(), StandardCharsets.UTF_8);
             } else {
                 return handleUnprocessableEntity(model, response, "error_message", "not authenticated", "invitations/accept_invite");
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpoint.java b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpoint.java
index b87a446d6c0..e1cfc11931a 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpoint.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpoint.java
@@ -21,6 +21,7 @@
 import org.cloudfoundry.identity.uaa.oauth.provider.ClientDetails;
 import org.springframework.stereotype.Controller;
 import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestParam;
@@ -40,6 +41,7 @@
 import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.INVITATION;
 import static org.cloudfoundry.identity.uaa.constants.OriginKeys.ORIGIN;
 import static org.cloudfoundry.identity.uaa.util.DomainFilter.filter;
+import static org.cloudfoundry.identity.uaa.web.AuthorizationManagersUtils.anyOf;
 import static org.cloudfoundry.identity.uaa.zone.IdentityZoneSwitchingFilter.HEADER;
 import static org.cloudfoundry.identity.uaa.zone.IdentityZoneSwitchingFilter.SUBDOMAIN_HEADER;
 import static org.cloudfoundry.identity.uaa.oauth.common.util.OAuth2Utils.CLIENT_ID;
@@ -58,15 +60,18 @@ public class InvitationsEndpoint {
     private final IdentityProviderProvisioning identityProviderProvisioning;
     private final MultitenantClientServices multitenantClientServices;
     private final ExpiringCodeStore expiringCodeStore;
+    private final boolean allowReinvite;
 
     public InvitationsEndpoint(final ScimUserProvisioning scimUserProvisioning,
             final @Qualifier("identityProviderProvisioning") IdentityProviderProvisioning identityProviderProvisioning,
             final MultitenantClientServices multitenantClientServices,
-            final ExpiringCodeStore expiringCodeStore) {
+            final ExpiringCodeStore expiringCodeStore,
+            final @Value("${scim.invite.allow_reinvite:true}") boolean allowReinvite) {
         this.scimUserProvisioning = scimUserProvisioning;
         this.identityProviderProvisioning = identityProviderProvisioning;
         this.multitenantClientServices = multitenantClientServices;
         this.expiringCodeStore = expiringCodeStore;
+        this.allowReinvite = allowReinvite;
     }
 
     @PostMapping(value = {"/invite_users", "/invite_users/"}, consumes = "application/json")
@@ -103,6 +108,10 @@ public ResponseEntity<InvitationsResponse> inviteUsers(@RequestBody InvitationsR
                     if (providers.size() == 1) {
                         FindResult findResult = findOrCreateUser(email, providers.getFirst().getOriginKey());
                         ScimUser user = findResult.user();
+                        if (!allowReinvite && user.isVerified() && !canReadUsers(authentication)) {
+                            invitationsResponse.getFailedInvites().add(InvitationsResponse.failure(email, "user.already-verified", "The user is already verified."));
+                            continue;
+                        }
                         String accountsUrl = UaaUrlUtils.getUaaUrl("/invitations/accept", !IdentityZoneHolder.isUaa(), IdentityZoneHolder.get());
 
                         Map<String, String> data = new HashMap<>();
@@ -159,6 +168,11 @@ private FindResult findOrCreateUser(String email, String origin) {
 
     record FindResult(ScimUser user, boolean newUser) {}
 
+    // same rule that grants GET /Users
+    private static boolean canReadUsers(Authentication authentication) {
+        return anyOf().hasScope("scim.read").isZoneAdmin().authorize(() -> authentication, null).isGranted();
+    }
+
     private boolean validateEmail(String email) {
         boolean valid = true;
         try {
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeController.java b/server/src/main/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeController.java
index 975ba488652..568ed763492 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeController.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeController.java
@@ -45,6 +45,9 @@ public String handleForcePasswordChange(Model model,
             @RequestParam("password_confirmation") String passwordConfirmation,
             HttpServletRequest request,
             HttpServletResponse response, HttpSession httpSession) {
+        if (!SessionUtils.isPasswordChangeRequired(httpSession)) {
+            return "redirect:/";
+        }
         SecurityContext securityContext = SecurityContextHolder.getContext();
         UaaAuthentication authentication = (UaaAuthentication) securityContext.getAuthentication();
         UaaPrincipal principal = authentication.getPrincipal();
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java
index 3dbe68d06a6..eec0b15e730 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java
@@ -94,7 +94,6 @@
 import org.springframework.util.StringUtils;
 import org.springframework.web.client.HttpClientErrorException;
 import org.springframework.web.client.RestTemplate;
-import org.springframework.web.context.request.RequestAttributes;
 import org.springframework.web.context.request.RequestContextHolder;
 import org.springframework.web.context.request.ServletRequestAttributes;
 
@@ -138,6 +137,8 @@
 import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.PHONE_NUMBER_ATTRIBUTE_NAME;
 import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.USER_NAME_ATTRIBUTE_NAME;
 import static org.cloudfoundry.identity.uaa.util.JwtTokenSignedByThisUAA.buildIdTokenValidator;
+import static org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils.getInvitationOrigin;
+import static org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils.getInvitedUserId;
 import static org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils.isAcceptedInvitationAuthentication;
 import static org.cloudfoundry.identity.uaa.util.UaaStringUtils.retainAllMatches;
 import static org.springframework.http.HttpMethod.GET;
@@ -563,7 +564,10 @@ protected UaaUser userAuthenticated(Authentication request, UaaUser userFromRequ
         String email = userFromRequest.getEmail();
         log.debug("ExternalOAuth user authenticated:{}", email);
         if (isInvitationAcceptance) {
-            String invitedUserId = (String) RequestContextHolder.currentRequestAttributes().getAttribute("user_id", RequestAttributes.SCOPE_SESSION);
+            if (!Objects.equals(authenticationData.getOrigin(), getInvitationOrigin())) {
+                throw new BadCredentialsException("OAuth identity provider does not match the invited identity provider.");
+            }
+            String invitedUserId = getInvitedUserId();
             log.debug("ExternalOAuth user accepted invitation, user_id:{}", invitedUserId);
             userFromDb = new UaaUser(getUserDatabase().retrieveUserPrototypeById(invitedUserId));
             if (email != null && !email.equalsIgnoreCase(userFromDb.getEmail())) {
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaAuthenticationUserManager.java b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaAuthenticationUserManager.java
index e4a491667e6..89998b18024 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaAuthenticationUserManager.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/saml/SamlUaaAuthenticationUserManager.java
@@ -52,6 +52,8 @@
 import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.FAMILY_NAME_ATTRIBUTE_NAME;
 import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.GIVEN_NAME_ATTRIBUTE_NAME;
 import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.PHONE_NUMBER_ATTRIBUTE_NAME;
+import static org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils.getInvitationOrigin;
+import static org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils.getInvitedUserId;
 import static org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils.isAcceptedInvitationAuthentication;
 
 /**
@@ -137,12 +139,19 @@ private UaaUser getAcceptedInvitationUser(UaaPrincipal samlPrincipal, CreateIfMi
         }
 
         context.setAddNew(false);
-        String invitedUserId = (String) RequestContextHolder.currentRequestAttributes().getAttribute("user_id", RequestAttributes.SCOPE_SESSION);
+        if (!Objects.equals(samlPrincipal.getOrigin(), getInvitationOrigin())) {
+            throw new BadCredentialsException("SAML identity provider does not match the invited identity provider.");
+        }
+        String invitedUserId = getInvitedUserId();
         UaaUser user = userDatabase.retrieveUserById(invitedUserId);
         if (context.hasEmailAttribute()) {
             if (!context.getEmailAttribute().equalsIgnoreCase(user.getEmail())) {
                 throw new BadCredentialsException("SAML User email mismatch. Authenticated email doesn't match invited email.");
             }
+        } else if (user.isVerified()) {
+            throw new BadCredentialsException("SAML User email missing. Authenticated email is required because the invited user is already verified.");
+        } else if (!user.getUsername().equals(user.getEmail())) {
+            throw new BadCredentialsException("SAML User email missing. Authenticated email is required because the invited user's username differs from the invited email.");
         } else {
             context.addEmailAttribute(user.getEmail());
         }
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/ScimUserProvisioning.java b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/ScimUserProvisioning.java
index 7026305f815..cc1cf412e88 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/ScimUserProvisioning.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/ScimUserProvisioning.java
@@ -48,6 +48,13 @@ List<ScimUser> retrieveByScimFilterOnlyActive(
 
     ScimUser verifyUser(String id, int version, String zoneId) throws ScimResourceNotFoundException, InvalidScimResourceException;
 
+    /**
+     * Atomically replaces the password and verifies an unverified user.
+     *
+     * @throws org.springframework.dao.OptimisticLockingFailureException if the user is already verified
+     */
+    ScimUser verifyUserAndSetPassword(String id, String newPassword, boolean passwordChangeRequired, String zoneId) throws ScimResourceNotFoundException;
+
     boolean checkPasswordMatches(String id, CharSequence password, String zoneId) throws ScimResourceNotFoundException;
 
     boolean checkPasswordChangeIndividuallyRequired(String id, String zoneId) throws ScimResourceNotFoundException;
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/beans/ScimAopConfig.java b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/beans/ScimAopConfig.java
index b85be48b2e0..b15fb1e3bcf 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/beans/ScimAopConfig.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/beans/ScimAopConfig.java
@@ -50,6 +50,12 @@ public void userVerified(ScimUser user) {
         scimEventPublisher.userVerified(user);
     }
 
+    @AfterReturning(pointcut = "execution(* *..ScimUserProvisioning+.verifyUserAndSetPassword(..)) && bean(scimUserProvisioning)", returning = "user")
+    public void userVerifiedAndPasswordChanged(ScimUser user) {
+        passwordEventPublisher.passwordChange(user.getId());
+        scimEventPublisher.userVerified(user);
+    }
+
     @AfterReturning(pointcut = "execution(* *..ScimUserEndpoints+.deleteUser(..)) && bean(scimUserEndpoints)", returning = "user")
     public void userDeleted(ScimUser user) {
         scimEventPublisher.userDeleted(user);
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpoints.java b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpoints.java
index 3bfef100c4a..2b332c3e02d 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpoints.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpoints.java
@@ -455,7 +455,7 @@ public ResponseEntity<VerificationResponse> getUserVerificationLink(@PathVariabl
             throw new UserAlreadyVerifiedException();
         }
 
-        ExpiringCode expiringCode = ScimUtils.getExpiringCode(codeStore, userId, user.getPrimaryEmail(), clientId, redirectUri, REGISTRATION, identityZoneManager.getCurrentIdentityZoneId());
+        ExpiringCode expiringCode = ScimUtils.getExpiringCode(codeStore, userId, user.getPrimaryEmail(), clientId, redirectUri, REGISTRATION, identityZoneManager.getCurrentIdentityZoneId(), Map.of(ScimUtils.USER_PROVISIONED, "true"));
         responseBody.setVerifyLink(ScimUtils.getVerificationURL(expiringCode, identityZoneManager.getCurrentIdentityZone()));
 
         return new ResponseEntity<>(responseBody, HttpStatus.OK);
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioning.java b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioning.java
index 74c6903a457..599faace05b 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioning.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioning.java
@@ -97,6 +97,8 @@ public Logger getLogger() {
 
     public static final String VERIFY_USER_SQL = "update users set verified=? where id=? and identity_zone_id=?";
 
+    public static final String VERIFY_USER_AND_SET_PASSWORD_SQL = "update users set lastModified=?, password=?, passwd_lastmodified=?, passwd_change_required=?, verified=? where id=? and identity_zone_id=? and verified=?";
+
     public static final String DELETE_USER_SQL = "delete from users where id=? and identity_zone_id=?";
 
     public static final String CHANGE_PASSWORD_SQL = "update users set lastModified=?, password=?, passwd_lastmodified=? where id=? and identity_zone_id=?";
@@ -492,6 +494,32 @@ public ScimUser verifyUser(String id, int version, String zoneId) throws ScimRes
         return user;
     }
 
+    @Override
+    public ScimUser verifyUserAndSetPassword(String id, String newPassword, boolean passwordChangeRequired, String zoneId)
+            throws ScimResourceNotFoundException {
+        String encodedPassword = passwordEncoder.encode(newPassword);
+        int updated = jdbcTemplate.update(VERIFY_USER_AND_SET_PASSWORD_SQL, ps -> {
+            Timestamp timestamp = new Timestamp(System.currentTimeMillis());
+            ps.setTimestamp(1, timestamp);
+            ps.setString(2, encodedPassword);
+            ps.setTimestamp(3, getPasswordLastModifiedTimestamp(timestamp));
+            ps.setBoolean(4, passwordChangeRequired);
+            ps.setBoolean(5, true);
+            ps.setString(6, id);
+            ps.setString(7, zoneId);
+            ps.setBoolean(8, false);
+        });
+
+        ScimUser user = retrieve(id, zoneId);
+        if (updated == 0) {
+            throw new OptimisticLockingFailureException("Attempt to activate already verified user " + id);
+        }
+        if (updated > 1) {
+            throw new IncorrectResultSizeDataAccessException(1);
+        }
+        return user;
+    }
+
     protected ScimUser deleteUser(ScimUser user, int version, String zoneId) {
         int updated = deleteUser(user.getId(), version, zoneId);
         if (updated == 0) {
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/util/ScimUtils.java b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/util/ScimUtils.java
index 729c16d2dd6..5c4ab1ff50e 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/scim/util/ScimUtils.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/scim/util/ScimUtils.java
@@ -24,6 +24,12 @@
 
 public final class ScimUtils {
 
+    /**
+     * Data entry of a verification code that was requested through the user API: the password of the
+     * account was set by the caller, so opening the link only has to verify the email address.
+     */
+    public static final String USER_PROVISIONED = "user_provisioned";
+
     private static final Logger logger = LoggerFactory.getLogger(ScimUtils.class);
 
     private ScimUtils() {
@@ -49,6 +55,21 @@ public static ExpiringCode getExpiringCode(
             String redirectUri,
             ExpiringCodeType intent,
             String currentZoneId) {
+        return getExpiringCode(codeStore, userId, email, clientId, redirectUri, intent, currentZoneId, Map.of());
+    }
+
+    /**
+     * Same as above, with extra entries for the data stored in the code.
+     */
+    public static ExpiringCode getExpiringCode(
+            ExpiringCodeStore codeStore,
+            String userId,
+            String email,
+            String clientId,
+            String redirectUri,
+            ExpiringCodeType intent,
+            String currentZoneId,
+            Map<String, String> additionalData) {
         Assert.notNull(codeStore, "codeStore must not be null");
         Assert.notNull(userId, "userId must not be null");
         Assert.notNull(email, "email must not be null");
@@ -61,6 +82,7 @@ public static ExpiringCode getExpiringCode(
         if (redirectUri != null) {
             codeData.put("redirect_uri", redirectUri);
         }
+        codeData.putAll(additionalData);
         String codeDataString = JsonUtils.writeValueAsString(codeData);
 
         Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + (60 * 60 * 1000)); // 1 hour
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/util/UaaHttpRequestUtils.java b/server/src/main/java/org/cloudfoundry/identity/uaa/util/UaaHttpRequestUtils.java
index 4e35d6d6492..dfa7d351fd4 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/util/UaaHttpRequestUtils.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/util/UaaHttpRequestUtils.java
@@ -70,6 +70,9 @@
 public abstract class UaaHttpRequestUtils {
 
     private static final Logger logger = LoggerFactory.getLogger(UaaHttpRequestUtils.class);
+    private static final String INVITATION_ACCEPTANCE_ATTRIBUTE = "IS_INVITE_ACCEPTANCE";
+    private static final String INVITED_USER_ID_ATTRIBUTE = "user_id";
+    private static final String INVITATION_ORIGIN_ATTRIBUTE = "invitation_origin";
 
     record HttpClientConfig(
             int poolSize,
@@ -259,20 +262,42 @@ private static String encodeParameter(String value) {
     }
 
     public static boolean isAcceptedInvitationAuthentication() {
+        return Boolean.TRUE.equals(getInvitationSessionAttribute(INVITATION_ACCEPTANCE_ATTRIBUTE));
+    }
+
+    public static String getInvitedUserId() {
+        return (String) getInvitationSessionAttribute(INVITED_USER_ID_ATTRIBUTE);
+    }
+
+    public static String getInvitationOrigin() {
+        return (String) getInvitationSessionAttribute(INVITATION_ORIGIN_ATTRIBUTE);
+    }
+
+    public static void setInvitationSessionAttributes(String userId, String origin) {
+        RequestAttributes attributes = RequestContextHolder.currentRequestAttributes();
+        attributes.setAttribute(INVITATION_ACCEPTANCE_ATTRIBUTE, true, RequestAttributes.SCOPE_SESSION);
+        attributes.setAttribute(INVITED_USER_ID_ATTRIBUTE, userId, RequestAttributes.SCOPE_SESSION);
+        attributes.setAttribute(INVITATION_ORIGIN_ATTRIBUTE, origin, RequestAttributes.SCOPE_SESSION);
+    }
+
+    public static void clearInvitationSessionAttributes() {
         try {
-            RequestAttributes attr = RequestContextHolder.currentRequestAttributes();
-            if (attr != null) {
-                Boolean result = (Boolean) attr.getAttribute("IS_INVITE_ACCEPTANCE", RequestAttributes.SCOPE_SESSION);
-                if (result != null) {
-                    return result;
-                }
-            }
+            RequestAttributes attributes = RequestContextHolder.currentRequestAttributes();
+            attributes.removeAttribute(INVITATION_ACCEPTANCE_ATTRIBUTE, RequestAttributes.SCOPE_SESSION);
+            attributes.removeAttribute(INVITED_USER_ID_ATTRIBUTE, RequestAttributes.SCOPE_SESSION);
+            attributes.removeAttribute(INVITATION_ORIGIN_ATTRIBUTE, RequestAttributes.SCOPE_SESSION);
         } catch (IllegalStateException _) {
-            //nothing bound on thread.
-            logger.debug("Unable to retrieve request attributes looking for invitation.");
+            logger.debug("Unable to retrieve request attributes while clearing invitation.");
+        }
+    }
 
+    private static Object getInvitationSessionAttribute(String name) {
+        try {
+            return RequestContextHolder.currentRequestAttributes().getAttribute(name, RequestAttributes.SCOPE_SESSION);
+        } catch (IllegalStateException _) {
+            logger.debug("Unable to retrieve request attributes looking for invitation.");
+            return null;
         }
-        return false;
     }
 
     private static class UaaConnectionKeepAliveStrategy implements ConnectionKeepAliveStrategy {
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandler.java b/server/src/main/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandler.java
index 4d7269ddee9..bd2883010e9 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandler.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandler.java
@@ -18,6 +18,7 @@
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
 import lombok.extern.slf4j.Slf4j;
 import org.cloudfoundry.identity.uaa.util.UaaStringUtils;
 import org.cloudfoundry.identity.uaa.util.UaaUrlUtils;
@@ -33,10 +34,14 @@
 import java.util.List;
 import java.util.Optional;
 
+import static org.cloudfoundry.identity.uaa.util.SessionUtils.SAVED_REQUEST_SESSION_ATTRIBUTE;
+
 @Slf4j
 public class UaaSavedRequestAwareAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
     public static final String URI_OVERRIDE_ATTRIBUTE = "override.redirect_uri";
     public static final String FORM_REDIRECT_PARAMETER = "form_redirect_uri";
+    private static final String TRUSTED_REDIRECT_SESSION_ATTRIBUTE =
+            UaaSavedRequestAwareAuthenticationSuccessHandler.class.getName() + ".TRUSTED_REDIRECT";
 
     private final HttpSessionRequestCache requestCache = new HttpSessionRequestCache();
 
@@ -44,6 +49,14 @@ public UaaSavedRequestAwareAuthenticationSuccessHandler() {
         requestCache.setMatchingRequestParameterName(null);
     }
 
+    public static void saveTrustedRedirect(HttpSession session, String redirectUri) {
+        if (session == null || !UaaStringUtils.hasText(redirectUri)) {
+            return;
+        }
+        session.setAttribute(TRUSTED_REDIRECT_SESSION_ATTRIBUTE, redirectUri);
+        session.removeAttribute(SAVED_REQUEST_SESSION_ATTRIBUTE);
+    }
+
     @Override
     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws ServletException, IOException {
         SavedRequest savedRequest = this.requestCache.getRequest(request, response);
@@ -75,15 +88,29 @@ public void onAuthenticationSuccess(HttpServletRequest request, HttpServletRespo
 
     @Override
     public String determineTargetUrl(HttpServletRequest request, HttpServletResponse response) {
+        String trustedRedirect = consumeTrustedRedirect(request);
         Object redirectAttribute = request.getAttribute(URI_OVERRIDE_ATTRIBUTE);
         String redirectFormParam = request.getParameter(FORM_REDIRECT_PARAMETER);
         if (redirectAttribute != null) {
             log.debug("Returning redirectAttribute saved URI: {}", redirectAttribute);
             return (String) redirectAttribute;
+        } else if (UaaStringUtils.hasText(trustedRedirect)) {
+            log.debug("Returning server-validated saved URI: {}", trustedRedirect);
+            return trustedRedirect;
         } else if (UaaUrlUtils.uriHasMatchingHost(redirectFormParam, request.getServerName())) {
             return redirectFormParam;
         } else {
             return super.determineTargetUrl(request, response);
         }
     }
+
+    private String consumeTrustedRedirect(HttpServletRequest request) {
+        HttpSession session = request.getSession(false);
+        if (session == null) {
+            return null;
+        }
+        Object redirect = session.getAttribute(TRUSTED_REDIRECT_SESSION_ATTRIBUTE);
+        session.removeAttribute(TRUSTED_REDIRECT_SESSION_ATTRIBUTE);
+        return redirect instanceof String string ? string : null;
+    }
 }
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilter.java
index adf19d1c93f..7b2c07afc8b 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilter.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilter.java
@@ -52,12 +52,17 @@ public IdentityZoneResolvingFilter(final IdentityZoneProvisioning dao,
 
     private static final String INTERNAL_ERROR_MESSAGE = "Internal server error while fetching identity zone for subdomain ";
     private static final String NOT_FOUND_MESSAGE = "Cannot find identity zone for subdomain ";
+    private static final String UNRECOGNIZED_HOSTNAME_MESSAGE = "Cannot find identity zone, unrecognized hostname: ";
 
     @Override
     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
             throws ServletException, IOException {
         String effectiveSubdomain = resolveEffectiveSubdomain(request, response);
-        if (effectiveSubdomain == null && response.isCommitted()) {
+        if (effectiveSubdomain == null) {
+            // no zone to look up: either the response is already sent (400), or the host is not a recognized one
+            if (!response.isCommitted()) {
+                handleZoneNotFound(null, request, response, filterChain);
+            }
             return;
         }
 
@@ -85,6 +90,10 @@ private String resolveEffectiveSubdomain(HttpServletRequest request, HttpServlet
                 response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Cannot use both subdomain and zone path");
                 return null;
             }
+            if (subdomainFromHost == null && !defaultZoneHostnames.isEmpty()) {
+                // the zone comes from the path, but the host is still none of the configured root domains
+                return null;
+            }
             return subdomainFromPath;
         }
         return subdomainFromHost;
@@ -94,9 +103,6 @@ private String resolveEffectiveSubdomain(HttpServletRequest request, HttpServlet
      * Looks up identity zone by subdomain. On generic exception sends 500 and returns null; caller should check response.isCommitted().
      */
     private IdentityZone resolveZoneBySubdomain(String subdomain, HttpServletResponse response) throws IOException {
-        if (subdomain == null) {
-            return null;
-        }
         try {
             return dao.retrieveBySubdomain(subdomain);
         } catch (EmptyResultDataAccessException _) {
@@ -119,7 +125,8 @@ private void handleZoneNotFound(String subdomain, HttpServletRequest request, Ht
             return;
         }
         request.setAttribute("error_message_code", "zone.not.found");
-        response.sendError(HttpServletResponse.SC_NOT_FOUND, NOT_FOUND_MESSAGE + subdomain);
+        String message = subdomain == null ? UNRECOGNIZED_HOSTNAME_MESSAGE + request.getServerName() : NOT_FOUND_MESSAGE + subdomain;
+        response.sendError(HttpServletResponse.SC_NOT_FOUND, message);
     }
 
     private void doFilterWithZone(IdentityZone identityZone, HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilter.java b/server/src/main/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilter.java
index 72969fcd961..ebe6be77cd5 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilter.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilter.java
@@ -115,7 +115,7 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
         if (DEFAULT_ZONE_SUBDOMAIN_PATH.equalsIgnoreCase(subdomain)) {
             // /z/default/... keeps /z/default in context path (like any other zone); same session as root via session key mapping.
             // Use canonical "default" in path so session key mapping (endsWith "/z/default") matches.
-            // Do not set ZONE_SUBDOMAIN_FROM_PATH so IdentityZoneResolvingFilter resolves default zone from hostname.
+            // An empty path subdomain explicitly selects the default zone and prevents a tenant hostname from taking precedence.
             String newContextPath = getNewContextPath(contextPath, DEFAULT_ZONE_SUBDOMAIN_PATH);
             HttpServletRequest wrappedRequest = new ZonePathRewrittenRequest(
                     request,
@@ -124,6 +124,7 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
                     pathResult.pathInfo()
             );
             wrappedRequest.setAttribute(ZONE_ORIGINAL_CONTEXT_PATH, contextPath);
+            wrappedRequest.setAttribute(ZONE_SUBDOMAIN_FROM_PATH, "");
             HttpServletResponse wrappedResponse = new CookiePathRewritingResponse(response, contextPath);
             filterChain.doFilter(wrappedRequest, wrappedResponse);
             return;
diff --git a/server/src/main/resources/templates/mail/account_exists.html b/server/src/main/resources/templates/mail/account_exists.html
new file mode 100644
index 00000000000..5012abe1126
--- /dev/null
+++ b/server/src/main/resources/templates/mail/account_exists.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head lang="en">
+    <meta charset="UTF-8" />
+</head>
+<body>
+<p>
+    A request has been made to use <th:block th:text="${email}">user@example.com</th:block> for a <th:block th:text="${serviceName}">ExampleService </th:block> account.
+</p>
+<p>
+    This email address already has an account, so no new account was created and your account has not changed.
+    You can sign in with your existing password, or use the forgot password link on the sign in page if you do not remember it.
+</p>
+<p>
+    If you did not make this request, simply ignore this message.
+</p>
+<p>
+    Thank you,<br />
+    <th:block th:text="${serviceName}">The Administration</th:block>
+</p>
+</body>
+</html>
diff --git a/server/src/main/resources/templates/web/accounts/email_sent.html b/server/src/main/resources/templates/web/accounts/email_sent.html
index 389d37b61b0..82ff6d04880 100644
--- a/server/src/main/resources/templates/web/accounts/email_sent.html
+++ b/server/src/main/resources/templates/web/accounts/email_sent.html
@@ -11,9 +11,12 @@ <h1>Create your <th:block th:text="${!companyName.equals('Cloud Foundry') and is
     </div>
     <div class="island-content">
         <i class="fa fa-envelope-o"></i>
-        <p class="instructions-sent" th:text="#{'email_sent.activation'}">
+        <p class="instructions-sent" th:if="${email == null}" th:text="#{'email_sent.activation'}">
             Check email for an activation link
         </p>
+        <p class="instructions-sent" th:if="${email != null}" th:text="#{email_sent.activation_address(${email})}">
+            Check user@example.com for an activation link
+        </p>
         <input type="submit" value="Email successfully sent" class="island-button" disabled="disabled"/>
     </div>
     <div class="island-footer">
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountCreationResponseTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountCreationResponseTest.java
new file mode 100644
index 00000000000..4962b75d261
--- /dev/null
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountCreationResponseTest.java
@@ -0,0 +1,21 @@
+package org.cloudfoundry.identity.uaa.account;
+
+import org.cloudfoundry.identity.uaa.util.JsonUtils;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class AccountCreationResponseTest {
+
+    @Test
+    void serializedResponseDoesNotContainThePasswordResetCode() {
+        AccountCreationService.AccountCreationResponse response = new AccountCreationService.AccountCreationResponse("user-id", "username", "user@example.com", "home");
+        response.setPasswordResetCode("the_reset_code");
+
+        String json = JsonUtils.writeValueAsString(response);
+
+        assertThat(json)
+                .contains("user_id", "user-id")
+                .doesNotContain("password_reset_code", "the_reset_code");
+    }
+}
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountsControllerViewZonePathTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountsControllerViewZonePathTests.java
index da1ed4214bf..94fb8acdfe0 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountsControllerViewZonePathTests.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/account/AccountsControllerViewZonePathTests.java
@@ -113,6 +113,26 @@ void accountsEmailSentPageContainsZoneAwareCreateAccountLink(ZoneRequestPathMode
         assertThat(result.getResponse().getContentAsString()).contains(expectedHref(mode, "/create_account"));
     }
 
+    @ParameterizedTest
+    @EnumSource(ZoneRequestPathMode.class)
+    void accountsEmailSentPageShowsTheAddressTheEmailWasSentTo(ZoneRequestPathMode mode) throws Exception {
+        setZoneWithSelfServiceEnabled(mode);
+        MvcResult result = mockMvc.perform(request(mode, "/accounts/email_sent").flashAttr("email", "user@example.com"))
+                .andExpect(status().isOk())
+                .andReturn();
+        assertThat(result.getResponse().getContentAsString()).contains("user@example.com");
+    }
+
+    @ParameterizedTest
+    @EnumSource(ZoneRequestPathMode.class)
+    void accountsEmailSentPageEscapesTheAddress(ZoneRequestPathMode mode) throws Exception {
+        setZoneWithSelfServiceEnabled(mode);
+        MvcResult result = mockMvc.perform(request(mode, "/accounts/email_sent").flashAttr("email", "<b>bold</b>@example.com"))
+                .andExpect(status().isOk())
+                .andReturn();
+        assertThat(result.getResponse().getContentAsString()).doesNotContain("<b>bold</b>");
+    }
+
     @ParameterizedTest
     @EnumSource(ZoneRequestPathMode.class)
     void createAccountPageContainsZoneAwareFormActionAndLoginLink(ZoneRequestPathMode mode) throws Exception {
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailServiceTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailServiceTest.java
index 86c48fb6a9c..d37ac7dd8b9 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailServiceTest.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/account/EmailChangeEmailServiceTest.java
@@ -27,6 +27,8 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.NullSource;
 import org.mockito.ArgumentCaptor;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
@@ -43,6 +45,7 @@
 import java.util.Map;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatCode;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.cloudfoundry.identity.uaa.account.EmailChangeEmailService.CHANGE_EMAIL_REDIRECT_URL;
 import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.EMAIL;
@@ -52,6 +55,7 @@
 import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.eq;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
@@ -151,7 +155,10 @@ void beginEmailChangeWithUsernameConflict() {
                 eq(zoneId))
         ).thenReturn(Collections.singletonList(new ScimUser()));
 
-        assertThatThrownBy(() -> emailChangeEmailService.beginEmailChange("user-001", "user@example.com", "new@example.com", null, null)).asInstanceOf(InstanceOfAssertFactories.throwable(UaaException.class));
+        assertThatCode(() -> emailChangeEmailService.beginEmailChange("user-001", "user@example.com", "new@example.com", null, null)).doesNotThrowAnyException();
+
+        verify(mockEmailService).sendMessage(eq("new@example.com"), any(MessageType.class), anyString(), anyString());
+        verify(mockExpiringCodeStore, never()).generateCode(anyString(), any(Timestamp.class), anyString(), anyString());
     }
 
     @Test
@@ -303,14 +310,55 @@ void completeActivationWithNoRedirectUri() {
         assertThat(response).containsEntry("redirect_url", "http://fallback.url/redirect");
     }
 
+    @Test
+    void completeVerificationWithoutFallbackGivesNoRedirectWhenClientHasNoRegisteredUris() {
+        UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, "authorization_grant", null, null);
+
+        Map<String, String> response = setUpCompleteActivation("user@example.com", "app", "http://other.example.com/page", clientDetails);
+
+        assertThat(response).containsEntry("redirect_url", null);
+    }
+
+    @Test
+    void completeVerificationWithoutFallbackGivesNoRedirectWhenRequestedUriMatchesNoRegisteredUri() {
+        UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, "authorization_grant", null, "http://app.com/*");
+
+        Map<String, String> response = setUpCompleteActivation("user@example.com", "app", "http://other.example.com/page", clientDetails);
+
+        assertThat(response).containsEntry("redirect_url", null);
+    }
+
+    @ParameterizedTest
+    @NullSource
+    void completeVerificationWithoutFallbackGivesNoRedirectWhenNoUriIsRequested(String requestedRedirectUri) {
+        UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, "authorization_grant", null, "http://app.com/*");
+
+        Map<String, String> response = setUpCompleteActivation("user@example.com", "app", requestedRedirectUri, clientDetails);
+
+        assertThat(response).containsEntry("redirect_url", null);
+    }
+
+    @Test
+    void completeVerificationWithoutFallbackKeepsRequestedUriThatMatchesRegisteredUri() {
+        UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, "authorization_grant", null, "http://app.com/*");
+
+        Map<String, String> response = setUpCompleteActivation("user@example.com", "app", "http://app.com/redirect", clientDetails);
+
+        assertThat(response).containsEntry("redirect_url", "http://app.com/redirect");
+    }
+
     private Map<String, String> setUpCompleteActivation(String username, String clientId, String redirectUri) {
+        UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, "authorization_grant", null, "http://app.com/*");
+        clientDetails.addAdditionalInformation(CHANGE_EMAIL_REDIRECT_URL, "http://fallback.url/redirect");
+        return setUpCompleteActivation(username, clientId, redirectUri, clientDetails);
+    }
+
+    private Map<String, String> setUpCompleteActivation(String username, String clientId, String redirectUri, UaaClientDetails clientDetails) {
         Map<String, String> codeData = new HashMap<>();
         codeData.put("user_id", "user-001");
         codeData.put("client_id", clientId);
         codeData.put("redirect_uri", redirectUri);
         codeData.put("email", "new@example.com");
-        UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, "authorization_grant", null, "http://app.com/*");
-        clientDetails.addAdditionalInformation(CHANGE_EMAIL_REDIRECT_URL, "http://fallback.url/redirect");
 
         when(mockExpiringCodeStore.retrieveCode("the_secret_code", zoneId)).thenReturn(new ExpiringCode("the_secret_code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), null));
         ScimUser user = new ScimUser("user-001", username, "", "");
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java
index c3c52c2d227..c25a1bd3015 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/account/ResetPasswordAuthenticationFilterTest.java
@@ -15,7 +15,9 @@
 
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.http.HttpServletResponse;
+import java.nio.charset.StandardCharsets;
 import java.sql.Timestamp;
+import java.util.concurrent.atomic.AtomicLong;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
@@ -35,11 +37,14 @@
 import org.cloudfoundry.identity.uaa.error.UaaException;
 import org.cloudfoundry.identity.uaa.scim.ScimUser;
 import org.cloudfoundry.identity.uaa.scim.exception.InvalidPasswordException;
+import org.cloudfoundry.identity.uaa.util.TimeService;
 import org.cloudfoundry.identity.uaa.util.TimeServiceImpl;
 import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.ArgumentCaptor;
 import org.springframework.http.HttpStatus;
 import org.springframework.mock.web.MockHttpServletRequest;
@@ -50,6 +55,9 @@
 import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
 import org.springframework.util.StringUtils;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
+import org.springframework.web.util.UriUtils;
 
 class ResetPasswordAuthenticationFilterTest {
 
@@ -111,6 +119,13 @@ void happy_day_password_reset_with_null_redirect() throws Exception {
         happy_day_password_reset(resetPasswordResponse.getRedirectUri());
     }
 
+    @Test
+    void happy_day_password_reset_with_query_in_redirect() throws Exception {
+        resetPasswordResponse = new ResetPasswordService.ResetPasswordResponse(user, "http://app.example.com/page?first=1&second=2#fragment", null);
+        when(service.resetPassword(any(ExpiringCode.class), eq(password))).thenReturn(resetPasswordResponse);
+        happy_day_password_reset(resetPasswordResponse.getRedirectUri());
+    }
+
     @Test
     void happy_day_password_reset_with_home_redirect() throws Exception {
         resetPasswordResponse = new ResetPasswordService.ResetPasswordResponse(user, "home", null);
@@ -118,6 +133,15 @@ void happy_day_password_reset_with_home_redirect() throws Exception {
         happy_day_password_reset("");
     }
 
+    private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) {
+        UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build();
+        assertThat(redirect.getPath()).endsWith("/login");
+        assertThat(redirect.getFragment()).isNull();
+        assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri");
+        assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("password_reset");
+        assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri);
+    }
+
     public void happy_day_password_reset(String redirectUri) throws Exception {
         filter.doFilterInternal(request, response, chain);
         //do our assertion
@@ -126,7 +150,9 @@ public void happy_day_password_reset(String redirectUri) throws Exception {
         if (!StringUtils.hasText(redirectUri) || "home".equals(redirectUri)) {
             verify(response, times(1)).sendRedirect(request.getContextPath() + "/login?success=password_reset");
         } else {
-            verify(response, times(1)).sendRedirect(request.getContextPath() + "/login?success=password_reset&form_redirect_uri=" + redirectUri);
+            ArgumentCaptor<String> redirectCaptor = ArgumentCaptor.forClass(String.class);
+            verify(response, times(1)).sendRedirect(redirectCaptor.capture());
+            assertRedirectsToLoginWithSingleFormRedirectUri(redirectCaptor.getValue(), redirectUri);
         }
         verify(chain, times(0)).doFilter(any(), any());
     }
@@ -159,6 +185,72 @@ void error_during_password_reset_invalid_password_exception() throws Exception {
         verify(service, times(1)).resetPassword(any(ExpiringCode.class), eq(password));
     }
 
+    @Test
+    void rejected_password_does_not_extend_the_code_lifetime() throws Exception {
+        when(service.resetPassword(any(ExpiringCode.class), anyString())).thenThrow(new InvalidPasswordException("failed", HttpStatus.BAD_REQUEST));
+
+        assertThat(codeLifetimeAfterFailedSubmit(false)).isNotNull();
+    }
+
+    @Test
+    void mismatched_confirmation_does_not_extend_the_code_lifetime() throws Exception {
+        assertThat(codeLifetimeAfterFailedSubmit(true)).isNotNull();
+    }
+
+    private ExpiringCode codeLifetimeAfterFailedSubmit(boolean mismatchedConfirmation) throws Exception {
+        var store = new InMemoryExpiringCodeStore(new TimeServiceImpl());
+        Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + 60_000);
+        var code = store.generateCode("{}", expiresAt, "forgot_password_for_id:id", IdentityZoneHolder.get().getId()).getCode();
+        var submit = MockMvcRequestBuilders.post("/reset_password.do")
+                .param("code", code)
+                .param("password", password)
+                .param("password_confirmation", mismatchedConfirmation ? "different" : password)
+                .param("email", email)
+                .buildRequest(new MockServletContext());
+
+        new ResetPasswordAuthenticationFilter(service, entryPoint, store).doFilterInternal(submit, response, chain);
+
+        ExpiringCode renewed = store.peekCode((String) submit.getAttribute("code"), IdentityZoneHolder.get().getId());
+        assertThat(renewed.getExpiresAt()).isBeforeOrEqualTo(expiresAt);
+        return renewed;
+    }
+
+    @ParameterizedTest
+    @ValueSource(booleans = {false, true})
+    void failed_submit_with_a_code_that_expires_meanwhile_reports_an_invalid_code(boolean mismatchedConfirmation) throws Exception {
+        AtomicLong now = new AtomicLong(System.currentTimeMillis());
+        TimeService clock = new TimeService() {
+            @Override
+            public long getCurrentTimeMillis() {
+                return now.get();
+            }
+        };
+        // The code is valid when it is redeemed and expires while the submitted password is checked.
+        var store = new InMemoryExpiringCodeStore(clock) {
+            @Override
+            public ExpiringCode retrieveCode(String code, String zoneId) {
+                ExpiringCode retrieved = super.retrieveCode(code, zoneId);
+                now.addAndGet(60_000);
+                return retrieved;
+            }
+        };
+        var code = store.generateCode("{}", new Timestamp(now.get() + 30_000), "forgot_password_for_id:id", IdentityZoneHolder.get().getId()).getCode();
+        when(service.resetPassword(any(ExpiringCode.class), anyString())).thenThrow(new InvalidPasswordException("failed", HttpStatus.BAD_REQUEST));
+        var submit = MockMvcRequestBuilders.post("/reset_password.do")
+                .param("code", code)
+                .param("password", password)
+                .param("password_confirmation", mismatchedConfirmation ? "different" : password)
+                .param("email", email)
+                .buildRequest(new MockServletContext());
+
+        new ResetPasswordAuthenticationFilter(service, entryPoint, store).doFilterInternal(submit, response, chain);
+
+        ArgumentCaptor<AuthenticationException> failure = ArgumentCaptor.forClass(AuthenticationException.class);
+        verify(entryPoint).commence(same(submit), same(response), failure.capture());
+        assertThat(failure.getValue()).hasCauseInstanceOf(InvalidCodeException.class);
+        assertThat(submit.getAttribute("code")).isNull();
+    }
+
     @Test
     void invalid_code_password_reset() throws Exception {
         request.setParameter("code", "invalid");
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilterTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilterTest.java
index b92b7471adf..c79a2ecd1a2 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilterTest.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasscodeAuthenticationFilterTest.java
@@ -4,14 +4,32 @@
 import org.cloudfoundry.identity.uaa.authentication.PasscodeAuthenticationFilter.ExpiringCodeAuthenticationManager;
 import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore;
 import org.cloudfoundry.identity.uaa.codestore.InMemoryExpiringCodeStore;
+import org.cloudfoundry.identity.uaa.passcode.PasscodeInformation;
+import org.cloudfoundry.identity.uaa.user.UaaUser;
+import org.cloudfoundry.identity.uaa.user.UaaUserDatabase;
+import org.cloudfoundry.identity.uaa.util.JsonUtils;
+import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder;
 import org.cloudfoundry.identity.uaa.util.MockTimeService;
 import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.NullSource;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.security.authentication.InsufficientAuthenticationException;
+import org.springframework.security.core.Authentication;
+
+import java.sql.Timestamp;
+import java.util.List;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
 
 
 class PasscodeAuthenticationFilterTest {
@@ -44,4 +62,60 @@ void setup() {
         ExpiringCodeStore expiringCodeStore = new InMemoryExpiringCodeStore(new MockTimeService());
         manager = new ExpiringCodeAuthenticationManager(null, null, logger, expiringCodeStore, null);
     }
-}
\ No newline at end of file
+
+    @Nested
+    class PasscodeIntent {
+
+        private static final String USER_ID = "user-id-1";
+
+        private ExpiringCodeStore expiringCodeStore;
+        private UaaUserDatabase userDatabase;
+        private ExpiringCodeAuthenticationManager passcodeManager;
+
+        @BeforeEach
+        void setUp() {
+            expiringCodeStore = new InMemoryExpiringCodeStore(new MockTimeService());
+            userDatabase = mock(UaaUserDatabase.class);
+            UaaUser user = mock(UaaUser.class);
+            doReturn(List.of()).when(user).getAuthorities();
+            when(userDatabase.retrieveUserById(USER_ID)).thenReturn(user);
+            passcodeManager = new ExpiringCodeAuthenticationManager(
+                    userDatabase, null, LoggerFactory.getLogger(PasscodeAuthenticationFilterTest.class), expiringCodeStore, null);
+        }
+
+        private String storePasscode(String intent) {
+            PasscodeInformation information = new PasscodeInformation(USER_ID, "marissa", "unused", "uaa", List.of());
+            return expiringCodeStore.generateCode(
+                    JsonUtils.writeValueAsString(information),
+                    new Timestamp(System.currentTimeMillis() + 60_000),
+                    intent,
+                    IdentityZoneHolder.get().getId()).getCode();
+        }
+
+        private ExpiringCodeAuthentication authenticationFor(String passcode) {
+            return new ExpiringCodeAuthentication(
+                    new PasscodeAuthenticationFilter.PasscodeHttpServletRequest(new MockHttpServletRequest("POST", "/oauth/token")),
+                    passcode);
+        }
+
+        @Test
+        void passcodeWithItsOwnIntentSignsIn() {
+            String passcode = storePasscode("PASSCODE " + USER_ID);
+
+            Authentication result = passcodeManager.authenticate(authenticationFor(passcode));
+
+            assertThat(result.getPrincipal()).hasFieldOrPropertyWithValue("id", USER_ID);
+        }
+
+        @ParameterizedTest
+        @NullSource
+        @ValueSource(strings = {"", "EMAIL", "AUTOLOGIN", "PASSCODE", "PASSCODE other-user-id", "passcode user-id-1", "my-application-code"})
+        void codeWithAnyOtherIntentIsRejected(String intent) {
+            String passcode = storePasscode(intent);
+
+            assertThatThrownBy(() -> passcodeManager.authenticate(authenticationFor(passcode)))
+                    .isInstanceOf(InsufficientAuthenticationException.class)
+                    .hasMessage("Invalid passcode");
+        }
+    }
+}
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilterTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilterTest.java
index 684cade59ba..94bb6b3034b 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilterTest.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/authentication/PasswordChangeUiRequiredFilterTest.java
@@ -7,6 +7,8 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
@@ -153,6 +155,32 @@ void tryingAccessForcePasswordPage() throws Exception {
         verify(mockHttpServletResponse, times(1)).sendRedirect("/");
     }
 
+    @ParameterizedTest
+    @ValueSource(strings = {"GET", "POST"})
+    void tryingAccessForcePasswordPageWithTrailingSlash(String method) throws Exception {
+        mockHttpServletRequest.setRequestURI("/force_password_change/");
+        mockHttpServletRequest.setMethod(method);
+        SecurityContextHolder.getContext().setAuthentication(mockUaaAuthentication);
+        when(mockUaaAuthentication.isAuthenticated()).thenReturn(true);
+        setRequiresPasswordChange(mockHttpServletRequest, false);
+        passwordChangeUiRequiredFilter.doFilterInternal(mockHttpServletRequest, mockHttpServletResponse, mockFilterChain);
+        verify(mockFilterChain, never()).doFilter(any(), any());
+        verify(mockHttpServletResponse, times(1)).sendRedirect("/");
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"GET", "POST"})
+    void changePasswordPageWithTrailingSlashWhenChangeIsRequired(String method) throws Exception {
+        mockHttpServletRequest.setRequestURI("/force_password_change/");
+        mockHttpServletRequest.setMethod(method);
+        SecurityContextHolder.getContext().setAuthentication(mockUaaAuthentication);
+        when(mockUaaAuthentication.isAuthenticated()).thenReturn(true);
+        setRequiresPasswordChange(mockHttpServletRequest, true);
+        passwordChangeUiRequiredFilter.doFilterInternal(mockHttpServletRequest, mockHttpServletResponse, mockFilterChain);
+        verify(mockFilterChain, times(1)).doFilter(same(mockHttpServletRequest), same(mockHttpServletResponse));
+        verify(mockHttpServletResponse, never()).sendRedirect(anyString());
+    }
+
     @Test
     void tryingAccessForcePasswordPageNotAuthenticated() throws Exception {
         mockHttpServletRequest.setPathInfo("/force_password_change");
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpointsTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpointsTests.java
index cf80667eb0c..1c2e298f107 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpointsTests.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/codestore/CodeStoreEndpointsTests.java
@@ -8,6 +8,9 @@
 import org.cloudfoundry.identity.uaa.zone.beans.IdentityZoneManager;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.NullSource;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.InOrder;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.HttpStatus;
@@ -20,8 +23,10 @@
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatNoException;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.inOrder;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
@@ -72,7 +77,7 @@ private String createDummyIdentityZone(@Autowired JdbcTemplate jdbcTemplate) {
     @Test
     void generateCode() {
         Timestamp expiresAt = new Timestamp(currentTime.get() + 60000);
-        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, null);
+        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, "EMAIL");
 
         ExpiringCode result = codeStoreEndpoints.generateCode(expiringCode);
 
@@ -85,45 +90,82 @@ void generateCode() {
 
         assertThat(result.getData()).isEqualTo(EMPTY_JSON);
 
-        verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, null, currentIdentityZoneId);
+        verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, "EMAIL", currentIdentityZoneId);
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"EMAIL", "INVITATION", "REGISTRATION", "email", "my-application-code"})
+    void generateCodeStoresGivenIntent(String intent) {
+        Timestamp expiresAt = new Timestamp(currentTime.get() + 60000);
+        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, intent);
+
+        ExpiringCode result = codeStoreEndpoints.generateCode(expiringCode);
+
+        assertThat(result.getIntent()).isEqualTo(intent);
+        verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, intent, currentIdentityZoneId);
+    }
+
+    @ParameterizedTest
+    @NullSource
+    @ValueSource(strings = {"", "  "})
+    void generateCodeWithoutIntent(String intent) {
+        Timestamp expiresAt = new Timestamp(currentTime.get() + 60000);
+        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, intent);
+
+        assertThatThrownBy(() -> codeStoreEndpoints.generateCode(expiringCode))
+                .isInstanceOf(CodeStoreException.class)
+                .hasMessage("intent is required. Known intents: EMAIL, INVITATION, REGISTRATION; custom values are accepted.")
+                .extracting("status")
+                .isEqualTo(HttpStatus.BAD_REQUEST);
+        verify(spiedExpiringCodeStore, never()).generateCode(any(), any(), any(), any());
+    }
+
+    @Test
+    void generateCodeWithNullBody() {
+        assertThatThrownBy(() -> codeStoreEndpoints.generateCode(null))
+                .isInstanceOf(CodeStoreException.class)
+                .hasMessage("intent is required. Known intents: EMAIL, INVITATION, REGISTRATION; custom values are accepted.")
+                .extracting("status")
+                .isEqualTo(HttpStatus.BAD_REQUEST);
+        verify(spiedExpiringCodeStore, never()).generateCode(any(), any(), any(), any());
     }
 
     @Test
     void generateCodeWithNullData() {
         Timestamp expiresAt = new Timestamp(currentTime.get() + 60000);
-        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, null, null);
+        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, null, "EMAIL");
 
         assertThatThrownBy(() -> codeStoreEndpoints.generateCode(expiringCode))
                 .isInstanceOf(CodeStoreException.class)
                 .hasMessage("data and expiresAt are required.")
                 .extracting("status")
                 .isEqualTo(HttpStatus.BAD_REQUEST);
-        verify(spiedExpiringCodeStore).generateCode(null, expiresAt, null, currentIdentityZoneId);
+        verify(spiedExpiringCodeStore).generateCode(null, expiresAt, "EMAIL", currentIdentityZoneId);
     }
 
     @Test
     void generateCodeWithNullExpiresAt() {
-        ExpiringCode expiringCode = new ExpiringCode(null, null, EMPTY_JSON, null);
+        ExpiringCode expiringCode = new ExpiringCode(null, null, EMPTY_JSON, "EMAIL");
 
         assertThatThrownBy(() -> codeStoreEndpoints.generateCode(expiringCode))
                 .isInstanceOf(CodeStoreException.class)
                 .hasMessage("data and expiresAt are required.")
                 .extracting("status")
                 .isEqualTo(HttpStatus.BAD_REQUEST);
-        verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, null, null, currentIdentityZoneId);
+        verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, null, "EMAIL", currentIdentityZoneId);
     }
 
     @Test
     void generateCodeWithExpiresAtInThePast() {
         Timestamp expiresAt = new Timestamp(currentTime.get() - 60000);
-        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, null);
+        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, "EMAIL");
 
         assertThatThrownBy(() -> codeStoreEndpoints.generateCode(expiringCode))
                 .isInstanceOf(CodeStoreException.class)
                 .hasMessage("expiresAt must be in the future.")
                 .extracting("status")
                 .isEqualTo(HttpStatus.BAD_REQUEST);
-        verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, null, currentIdentityZoneId);
+        verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, "EMAIL", currentIdentityZoneId);
     }
 
     @Test
@@ -133,7 +175,7 @@ void generateCodeWithDuplicateCode() {
         spiedExpiringCodeStore.setGenerator(generator);
 
         Timestamp expiresAt = new Timestamp(currentTime.get() + 60000);
-        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, null);
+        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, "EMAIL");
 
         assertThatNoException().isThrownBy(() -> codeStoreEndpoints.generateCode(expiringCode));
 
@@ -143,13 +185,13 @@ void generateCodeWithDuplicateCode() {
                 .extracting("status")
                 .isEqualTo(HttpStatus.INTERNAL_SERVER_ERROR);
         verify(spiedExpiringCodeStore, times(2))
-                .generateCode(EMPTY_JSON, expiresAt, null, currentIdentityZoneId);
+                .generateCode(EMPTY_JSON, expiresAt, "EMAIL", currentIdentityZoneId);
     }
 
     @Test
     void retrieveCode() {
         Timestamp expiresAt = new Timestamp(currentTime.get() + 60000);
-        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, null);
+        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, "EMAIL");
         ExpiringCode generatedCode = codeStoreEndpoints.generateCode(expiringCode);
 
         String code = generatedCode.getCode();
@@ -163,7 +205,7 @@ void retrieveCode() {
                 .isEqualTo(HttpStatus.NOT_FOUND);
 
         InOrder inOrder = inOrder(spiedExpiringCodeStore);
-        inOrder.verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, null, currentIdentityZoneId);
+        inOrder.verify(spiedExpiringCodeStore).generateCode(EMPTY_JSON, expiresAt, "EMAIL", currentIdentityZoneId);
         inOrder.verify(spiedExpiringCodeStore).retrieveCode(code, currentIdentityZoneId);
     }
 
@@ -193,7 +235,7 @@ void storeLargeData() {
         Arrays.fill(oneMb, 'a');
         String data = new String(oneMb);
         Timestamp expiresAt = new Timestamp(currentTime.get() + 60000);
-        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, data, null);
+        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, data, "EMAIL");
 
         ExpiringCode generatedCode = codeStoreEndpoints.generateCode(expiringCode);
 
@@ -202,7 +244,7 @@ void storeLargeData() {
 
         assertThat(actualCode).isEqualTo(generatedCode);
         InOrder inOrder = inOrder(spiedExpiringCodeStore);
-        inOrder.verify(spiedExpiringCodeStore).generateCode(data, expiresAt, null, currentIdentityZoneId);
+        inOrder.verify(spiedExpiringCodeStore).generateCode(data, expiresAt, "EMAIL", currentIdentityZoneId);
         inOrder.verify(spiedExpiringCodeStore).retrieveCode(code, currentIdentityZoneId);
     }
 
@@ -210,7 +252,7 @@ void storeLargeData() {
     void retrieveCodeWithExpiredCode() {
         int expiresIn = 1000;
         Timestamp expiresAt = new Timestamp(currentTime.get() + expiresIn);
-        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, null);
+        ExpiringCode expiringCode = new ExpiringCode(null, expiresAt, EMPTY_JSON, "EMAIL");
 
         ExpiringCode generatedCode = codeStoreEndpoints.generateCode(expiringCode);
         currentTime.addAndGet(expiresIn + 1);
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsServiceTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsServiceTests.java
index 43cb3fce808..80638af9115 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsServiceTests.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/EmailInvitationsServiceTests.java
@@ -34,7 +34,7 @@
 import static org.cloudfoundry.identity.uaa.invitations.EmailInvitationsService.USER_ID;
 import static org.cloudfoundry.identity.uaa.oauth.common.util.OAuth2Utils.CLIENT_ID;
 import static org.cloudfoundry.identity.uaa.oauth.common.util.OAuth2Utils.REDIRECT_URI;
-import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.Mockito.anyInt;
 import static org.mockito.Mockito.anyString;
 import static org.mockito.Mockito.doThrow;
@@ -78,8 +78,9 @@ void setUp() {
     void acceptInvitationNoClientId() {
         ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last");
         user.setOrigin(UAA);
+        user.setVerified(false);
         when(mockScimUserProvisioning.retrieve(eq("user-id-001"), eq(zoneId))).thenReturn(user);
-        when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user);
+        when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), eq(false), eq(zoneId))).thenReturn(user);
         doThrow(NoSuchClientException.class).when(mockClientDetailsService).loadClientByClientId(null, zoneId);
 
         Map<String, String> userData = new HashMap<>();
@@ -89,8 +90,7 @@ void acceptInvitationNoClientId() {
         when(mockExpiringCodeStore.retrieveCode(anyString(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(userData), INVITATION.name()));
 
         String redirectLocation = emailInvitationsService.acceptInvitation("code", "password").getRedirectUri();
-        verify(mockScimUserProvisioning).verifyUser(user.getId(), user.getVersion(), zoneId);
-        verify(mockScimUserProvisioning).changePassword(user.getId(), null, "password", zoneId);
+        verify(mockScimUserProvisioning).verifyUserAndSetPassword(user.getId(), "password", false, zoneId);
         assertThat(redirectLocation).isEqualTo("/home");
     }
 
@@ -110,6 +110,7 @@ void nonMatchingCodeIntent() {
     void acceptInvitation_withoutPasswordUpdate() {
         ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last");
         user.setOrigin(UAA);
+        user.setVerified(false);
 
         UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, null, null, "http://example.com/*/");
         when(mockClientDetailsService.loadClientByClientId("acmeClientId", zoneId)).thenReturn(clientDetails);
@@ -153,7 +154,8 @@ void acceptInvitation_onlyMarksInternalUsersAsVerified() {
     void acceptInvitationWithClientNotFound() {
         ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last");
         user.setOrigin(OriginKeys.UAA);
-        when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user);
+        user.setVerified(false);
+        when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), eq(false), eq(zoneId))).thenReturn(user);
         when(mockScimUserProvisioning.retrieve(eq("user-id-001"), eq(zoneId))).thenReturn(user);
         doThrow(new NoSuchClientException("Client not found")).when(mockClientDetailsService).loadClientByClientId("client-not-found", zoneId);
 
@@ -165,8 +167,7 @@ void acceptInvitationWithClientNotFound() {
 
         String redirectLocation = emailInvitationsService.acceptInvitation("code", "password").getRedirectUri();
 
-        verify(mockScimUserProvisioning).verifyUser(user.getId(), user.getVersion(), zoneId);
-        verify(mockScimUserProvisioning).changePassword(user.getId(), null, "password", zoneId);
+        verify(mockScimUserProvisioning).verifyUserAndSetPassword(user.getId(), "password", false, zoneId);
         assertThat(redirectLocation).isEqualTo("/home");
     }
 
@@ -174,9 +175,10 @@ void acceptInvitationWithClientNotFound() {
     void acceptInvitationWithValidRedirectUri() {
         ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last");
         user.setOrigin(UAA);
+        user.setVerified(false);
         UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, null, null, "http://example.com/*/");
         when(mockScimUserProvisioning.retrieve(eq("user-id-001"), eq(zoneId))).thenReturn(user);
-        when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user);
+        when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), eq(false), eq(zoneId))).thenReturn(user);
         when(mockClientDetailsService.loadClientByClientId("acmeClientId", zoneId)).thenReturn(clientDetails);
 
         Map<String, String> userData = new HashMap<>();
@@ -188,8 +190,7 @@ void acceptInvitationWithValidRedirectUri() {
 
         String redirectLocation = emailInvitationsService.acceptInvitation("code", "password").getRedirectUri();
 
-        verify(mockScimUserProvisioning).verifyUser(user.getId(), user.getVersion(), zoneId);
-        verify(mockScimUserProvisioning).changePassword(user.getId(), null, "password", zoneId);
+        verify(mockScimUserProvisioning).verifyUserAndSetPassword(user.getId(), "password", false, zoneId);
         assertThat(redirectLocation).isEqualTo("http://example.com/redirect/");
     }
 
@@ -197,8 +198,9 @@ void acceptInvitationWithValidRedirectUri() {
     void acceptInvitationWithInvalidRedirectUri() {
         ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last");
         user.setOrigin(UAA);
+        user.setVerified(false);
         UaaClientDetails clientDetails = new UaaClientDetails("client-id", null, null, null, null, "http://example.com/redirect");
-        when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user);
+        when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), eq(false), eq(zoneId))).thenReturn(user);
         when(mockScimUserProvisioning.retrieve(eq("user-id-001"), eq(zoneId))).thenReturn(user);
         when(mockClientDetailsService.loadClientByClientId("acmeClientId", zoneId)).thenReturn(clientDetails);
         Map<String, String> userData = new HashMap<>();
@@ -210,8 +212,7 @@ void acceptInvitationWithInvalidRedirectUri() {
 
         String redirectLocation = emailInvitationsService.acceptInvitation("code", "password").getRedirectUri();
 
-        verify(mockScimUserProvisioning).verifyUser(user.getId(), user.getVersion(), zoneId);
-        verify(mockScimUserProvisioning).changePassword(user.getId(), null, "password", zoneId);
+        verify(mockScimUserProvisioning).verifyUserAndSetPassword(user.getId(), "password", false, zoneId);
         assertThat(redirectLocation).isEqualTo("/home");
     }
 
@@ -219,8 +220,8 @@ void acceptInvitationWithInvalidRedirectUri() {
     void acceptInvitation_existingUser_withPassword_doesNotChangePassword() {
         ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last");
         user.setOrigin(UAA);
+        user.setVerified(true);
         when(mockScimUserProvisioning.retrieve(eq("user-id-001"), eq(zoneId))).thenReturn(user);
-        when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user);
         doThrow(NoSuchClientException.class).when(mockClientDetailsService).loadClientByClientId(null, zoneId);
 
         Map<String, String> userData = new HashMap<>();
@@ -234,16 +235,42 @@ void acceptInvitation_existingUser_withPassword_doesNotChangePassword() {
 
         emailInvitationsService.acceptInvitation("code", "attackerChosenPassword");
 
+        verify(mockScimUserProvisioning, never()).verifyUser(anyString(), anyInt(), anyString());
+        verify(mockScimUserProvisioning, never()).verifyUserAndSetPassword(anyString(), anyString(), anyBoolean(), anyString());
+    }
+
+    @Test
+    void acceptInvitation_existingUnverifiedUser_doesNotChangePassword() {
+        ScimUser user = new ScimUser("user-id-001", "user@example.com", "first", "last");
+        user.setOrigin(UAA);
+        user.setVerified(false);
+        when(mockScimUserProvisioning.retrieve(eq("user-id-001"), eq(zoneId))).thenReturn(user);
+        when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user);
+        doThrow(NoSuchClientException.class).when(mockClientDetailsService).loadClientByClientId(null, zoneId);
+
+        Map<String, String> userData = new HashMap<>();
+        userData.put(USER_ID, "user-id-001");
+        userData.put(EMAIL, "user@example.com");
+        userData.put(CLIENT_ID, null);
+        userData.put(InvitationsEndpoint.CREATED_NEW_USER, "false");
+        when(mockExpiringCodeStore.retrieveCode(anyString(), eq(zoneId)))
+                .thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()),
+                        JsonUtils.writeValueAsString(userData), INVITATION.name()));
+
+        emailInvitationsService.acceptInvitation("code", "submittedPassword");
+
         verify(mockScimUserProvisioning).verifyUser(user.getId(), user.getVersion(), zoneId);
-        verify(mockScimUserProvisioning, never()).changePassword(any(), any(), any(), any());
+        verify(mockScimUserProvisioning, never())
+                .verifyUserAndSetPassword(anyString(), anyString(), anyBoolean(), anyString());
     }
 
     @Test
     void acceptInvitation_newUser_withPassword_stillChangesPassword() {
         ScimUser user = new ScimUser("user-id-002", "newuser@example.com", "first", "last");
         user.setOrigin(UAA);
+        user.setVerified(false);
         when(mockScimUserProvisioning.retrieve(eq("user-id-002"), eq(zoneId))).thenReturn(user);
-        when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(zoneId))).thenReturn(user);
+        when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), eq(false), eq(zoneId))).thenReturn(user);
         doThrow(NoSuchClientException.class).when(mockClientDetailsService).loadClientByClientId(null, zoneId);
 
         Map<String, String> userData = new HashMap<>();
@@ -257,7 +284,6 @@ void acceptInvitation_newUser_withPassword_stillChangesPassword() {
 
         emailInvitationsService.acceptInvitation("code", "newUserPassword");
 
-        verify(mockScimUserProvisioning).verifyUser(user.getId(), user.getVersion(), zoneId);
-        verify(mockScimUserProvisioning).changePassword(user.getId(), null, "newUserPassword", zoneId);
+        verify(mockScimUserProvisioning).verifyUserAndSetPassword(user.getId(), "newUserPassword", false, zoneId);
     }
 }
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java
index 8cbc501daae..ca084ea8c92 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerTest.java
@@ -1,5 +1,6 @@
 package org.cloudfoundry.identity.uaa.invitations;
 
+import java.nio.charset.StandardCharsets;
 import org.cloudfoundry.identity.uaa.authentication.UaaPrincipal;
 import org.cloudfoundry.identity.uaa.authentication.manager.DynamicLdapAuthenticationManager;
 import org.cloudfoundry.identity.uaa.authentication.manager.DynamicZoneAwareAuthenticationManager;
@@ -39,6 +40,7 @@
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Import;
 import org.springframework.context.support.ResourceBundleMessageSource;
+import org.springframework.mock.web.MockHttpSession;
 import org.springframework.security.authentication.AnonymousAuthenticationToken;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.BadCredentialsException;
@@ -63,6 +65,9 @@
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
+import org.springframework.web.util.UriUtils;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.INVITATION;
@@ -204,6 +209,20 @@ void acceptInvitePage_for_unverifiedSamlUser() throws Exception {
 
         assertThat(result.getRequest().getSession().getAttribute("IS_INVITE_ACCEPTANCE")).isEqualTo(true);
         assertThat(result.getRequest().getSession().getAttribute("user_id")).isEqualTo("user-id-001");
+        assertThat(result.getRequest().getSession().getAttribute("invitation_origin")).isEqualTo("test-saml");
+
+        MockHttpSession session = (MockHttpSession) result.getRequest().getSession();
+        when(invitationsService.acceptInvitation("the_secret_code", ""))
+                .thenReturn(new AcceptedInvitation("https://client.example.com/callback", new ScimUser()));
+
+        mockMvc.perform(get("/invitations/accept")
+                        .session(session)
+                        .param("code", "the_secret_code"))
+                .andExpect(redirectedUrl("https://client.example.com/callback"));
+
+        assertThat(session.getAttribute("IS_INVITE_ACCEPTANCE")).isNull();
+        assertThat(session.getAttribute("user_id")).isNull();
+        assertThat(session.getAttribute("invitation_origin")).isNull();
     }
 
     @Test
@@ -230,6 +249,7 @@ void acceptInvitePage_for_unverifiedOIDCUser() throws Exception {
 
         assertThat(result.getRequest().getSession().getAttribute("IS_INVITE_ACCEPTANCE")).isEqualTo(true);
         assertThat(result.getRequest().getSession().getAttribute("user_id")).isEqualTo("user-id-001");
+        assertThat(result.getRequest().getSession().getAttribute("invitation_origin")).isEqualTo("test-oidc");
     }
 
     @Test
@@ -288,6 +308,7 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn() throws Exception {
 
         ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f");
         invitedUser.setPrimaryEmail("user@example.com");
+        invitedUser.setOrigin(LDAP);
 
         when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser);
         when(invitationsService.acceptInvitation(anyString(), anyString())).thenReturn(new AcceptedInvitation("blah.test.com", new ScimUser()));
@@ -310,6 +331,99 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn() throws Exception {
         verify(ldapAuthenticationManager).authenticate(any());
     }
 
+    @Test
+    void ldapInviteAcceptanceReissuesCodeWithItsIntent() throws Exception {
+        Map<String, String> codeData = getInvitationsCode(LDAP);
+        String zoneId = IdentityZoneHolder.get().getId();
+        when(expiringCodeStore.retrieveCode("the_secret_code", zoneId)).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name()));
+        when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name()));
+        DynamicLdapAuthenticationManager ldapAuthenticationManager = mock(DynamicLdapAuthenticationManager.class);
+        when(zoneAwareAuthenticationManager.getLdapAuthenticationManager(any(), any())).thenReturn(ldapAuthenticationManager);
+
+        AuthenticationManager ldapActual = mock(AuthenticationManager.class);
+        when(ldapAuthenticationManager.getLdapManagerActual()).thenReturn(ldapActual);
+
+        Authentication auth = mock(Authentication.class);
+        when(auth.isAuthenticated()).thenReturn(true);
+        when(ldapActual.authenticate(any())).thenReturn(auth);
+
+        ExtendedLdapUserDetails extendedLdapUserDetails = mock(ExtendedLdapUserDetails.class);
+
+        when(auth.getPrincipal()).thenReturn(extendedLdapUserDetails);
+        when(extendedLdapUserDetails.getEmailAddress()).thenReturn("user@example.com");
+        when(extendedLdapUserDetails.getUsername()).thenReturn("test-ldap-user");
+
+        ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f");
+        invitedUser.setPrimaryEmail("user@example.com");
+        invitedUser.setOrigin(LDAP);
+
+        when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser);
+        when(invitationsService.acceptInvitation(anyString(), anyString())).thenReturn(new AcceptedInvitation("blah.test.com", new ScimUser()));
+        when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name()));
+
+        mockMvc.perform(post("/invitations/accept_enterprise.do")
+                        .param("enterprise_username", "test-ldap-user")
+                        .param("enterprise_password", "password")
+                        .param("enterprise_email", "email")
+                        .param("code", "the_secret_code"))
+                .andExpect(redirectedUrl("/login?success=invite_accepted&form_redirect_uri=blah.test.com"))
+                .andReturn();
+
+
+        verify(expiringCodeStore, times(1)).generateCode(anyString(), any(), eq(INVITATION.name()), eq(zoneId));
+    }
+
+    @Test
+    void ldapInviteWithWrongIntentIsRejectedBeforeAuthenticationOrMutation() throws Exception {
+        Map<String, String> codeData = getInvitationsCode(LDAP);
+        String zoneId = IdentityZoneHolder.get().getId();
+        when(expiringCodeStore.retrieveCode("the_secret_code", zoneId))
+                .thenReturn(new ExpiringCode(
+                        "code",
+                        new Timestamp(System.currentTimeMillis()),
+                        JsonUtils.writeValueAsString(codeData),
+                        "wrong-intent"));
+
+        mockMvc.perform(post("/invitations/accept_enterprise.do")
+                        .param("enterprise_username", "test-ldap-user")
+                        .param("enterprise_password", "password")
+                        .param("enterprise_email", "email")
+                        .param("code", "the_secret_code"))
+                .andExpect(status().isUnprocessableEntity())
+                .andExpect(model().attribute("error_message_code", "code_expired"));
+
+        verify(zoneAwareAuthenticationManager, never()).getLdapAuthenticationManager(any(), any());
+        verify(scimUserProvisioning, never()).update(anyString(), any(), anyString());
+        verify(invitationsService, never()).acceptInvitation(anyString(), anyString());
+    }
+
+    @Test
+    void ldapInviteForNonLdapUserIsRejectedBeforeAuthenticationOrMutation() throws Exception {
+        Map<String, String> codeData = getInvitationsCode(LDAP);
+        String zoneId = IdentityZoneHolder.get().getId();
+        when(expiringCodeStore.retrieveCode("the_secret_code", zoneId))
+                .thenReturn(new ExpiringCode(
+                        "code",
+                        new Timestamp(System.currentTimeMillis()),
+                        JsonUtils.writeValueAsString(codeData),
+                        INVITATION.name()));
+        ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f");
+        invitedUser.setOrigin(OriginKeys.UAA);
+        when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser);
+
+        mockMvc.perform(post("/invitations/accept_enterprise.do")
+                        .param("enterprise_username", "test-ldap-user")
+                        .param("enterprise_password", "password")
+                        .param("enterprise_email", "email")
+                        .param("code", "the_secret_code"))
+                .andExpect(status().isUnprocessableEntity())
+                .andExpect(model().attribute("error_message_code", "code_expired"));
+
+        verify(zoneAwareAuthenticationManager, never()).getLdapAuthenticationManager(any(), any());
+        verify(scimUserProvisioning, never()).update(anyString(), any(), anyString());
+        verify(invitationsService, never()).acceptInvitation(anyString(), anyString());
+    }
+
     @Test
     void unverifiedLdapUser_acceptsInvite_byLoggingIn_bad_credentials() throws Exception {
         Map<String, String> codeData = getInvitationsCode("ldap");
@@ -325,6 +439,9 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn_bad_credentials() throws Excep
         Authentication auth = mock(Authentication.class);
         when(auth.isAuthenticated()).thenReturn(true);
         when(ldapActual.authenticate(any())).thenThrow(new BadCredentialsException("bad creds"));
+        ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f");
+        invitedUser.setOrigin(LDAP);
+        when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser);
 
         mockMvc.perform(post("/invitations/accept_enterprise.do")
                         .param("enterprise_username", "test-ldap-user")
@@ -356,6 +473,7 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn_whereEmailDoesNotMatchAuthenti
 
         ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f");
         invitedUser.setPrimaryEmail("user@example.com");
+        invitedUser.setOrigin(LDAP);
         when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser);
         when(expiringCodeStore.generateCode(anyString(), any(), eq(null), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), null));
 
@@ -375,6 +493,43 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn_whereEmailDoesNotMatchAuthenti
         verify(ldapActual).authenticate(any());
     }
 
+    @Test
+    void ldapInviteEmailMismatchReissuesCodesWithTheirIntent() throws Exception {
+        Map<String, String> codeData = getInvitationsCode(LDAP);
+        String zoneId = IdentityZoneHolder.get().getId();
+        when(expiringCodeStore.retrieveCode("the_secret_code", zoneId)).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name()));
+        DynamicLdapAuthenticationManager ldapAuthenticationManager = mock(DynamicLdapAuthenticationManager.class);
+        when(zoneAwareAuthenticationManager.getLdapAuthenticationManager(any(), any())).thenReturn(ldapAuthenticationManager);
+
+        AuthenticationManager ldapActual = mock(AuthenticationManager.class);
+        when(ldapAuthenticationManager.getLdapManagerActual()).thenReturn(ldapActual);
+        Authentication auth = mock(Authentication.class);
+        when(ldapActual.authenticate(any())).thenReturn(auth);
+
+        ExtendedLdapUserDetails extendedLdapUserDetails = mock(ExtendedLdapUserDetails.class);
+        when(auth.getPrincipal()).thenReturn(extendedLdapUserDetails);
+        when(extendedLdapUserDetails.getEmailAddress()).thenReturn("different-email@example.com");
+
+        ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f");
+        invitedUser.setPrimaryEmail("user@example.com");
+        invitedUser.setOrigin(LDAP);
+        when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser);
+        when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name()));
+
+        mockMvc.perform(post("/invitations/accept_enterprise.do")
+                        .param("enterprise_username", "test-ldap-user")
+                        .param("enterprise_password", "password")
+                        .param("enterprise_email", "email")
+                        .param("code", "the_secret_code"))
+                .andExpect(status().isUnprocessableEntity())
+                .andExpect(view().name("invitations/accept_invite"))
+                .andExpect(model().attribute("code", "code"))
+                .andExpect(model().attribute("error_message", "invite.email_mismatch"))
+                .andReturn();
+
+        verify(expiringCodeStore, times(2)).generateCode(anyString(), any(), eq(INVITATION.name()), eq(zoneId));
+    }
+
     @Test
     void acceptInvitePage_for_verifiedUser() throws Exception {
         String zoneId = IdentityZoneHolder.get().getId();
@@ -457,6 +612,28 @@ void missing_code() throws Exception {
         verify(invitationsService, never()).acceptInvitation(anyString(), anyString());
     }
 
+    @Test
+    void acceptInviteWithWrongIntentIsRejectedBeforeCodeRegeneration() throws Exception {
+        MockHttpServletRequestBuilder post = startAcceptInviteFlow("password", "password");
+        String zoneId = IdentityZoneHolder.get().getId();
+        Map<String, String> codeData = getInvitationsCode(OriginKeys.UAA);
+        when(expiringCodeStore.retrieveCode("thecode", zoneId))
+                .thenReturn(new ExpiringCode(
+                        "thecode",
+                        new Timestamp(System.currentTimeMillis()),
+                        JsonUtils.writeValueAsString(codeData),
+                        "wrong-intent"));
+
+        mockMvc.perform(post)
+                .andExpect(status().isUnprocessableEntity())
+                .andExpect(model().attribute("error_message_code", "code_expired"))
+                .andExpect(view().name("invitations/accept_invite"));
+
+        verify(expiringCodeStore, never()).generateCode(anyString(), any(), any(), eq(zoneId));
+        verify(invitationsService, never()).acceptInvitation(anyString(), anyString());
+        assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
+    }
+
     @Test
     void invalid_principal_id() throws Exception {
         MockHttpServletRequestBuilder post = startAcceptInviteFlow("a", "a");
@@ -534,6 +711,15 @@ void acceptInvite() throws Exception {
         verify(invitationsService).acceptInvitation(anyString(), eq("passw0rd"));
     }
 
+    private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) {
+        UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build();
+        assertThat(redirect.getPath()).endsWith("/login");
+        assertThat(redirect.getFragment()).isNull();
+        assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri");
+        assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("invite_accepted");
+        assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri);
+    }
+
     private MockHttpServletRequestBuilder startAcceptInviteFlow(String password, String passwordConfirmation) {
         String zoneId = IdentityZoneHolder.get().getId();
         UaaPrincipal uaaPrincipal = new UaaPrincipal("user-id-001", "user@example.com", "user@example.com", OriginKeys.UAA, null, zoneId);
@@ -572,6 +758,34 @@ void acceptInviteWithValidClientRedirect() throws Exception {
                 .andExpect(redirectedUrl("/login?success=invite_accepted&form_redirect_uri=valid.redirect.com"));
     }
 
+    @Test
+    void acceptInviteKeepsRedirectUrlWithQueryAsOneFormRedirectParameter() throws Exception {
+        String zoneId = IdentityZoneHolder.get().getId();
+        UaaPrincipal uaaPrincipal = new UaaPrincipal("user-id-001", "user@example.com", "user@example.com", OriginKeys.UAA, null, zoneId);
+        ScimUser user = new ScimUser(uaaPrincipal.getId(), uaaPrincipal.getName(), "fname", "lname");
+        user.setPrimaryEmail(user.getUserName());
+
+        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(uaaPrincipal, null, UaaAuthority.USER_AUTHORITIES);
+        SecurityContextHolder.getContext().setAuthentication(token);
+
+        Map<String, String> codeData = getInvitationsCode(OriginKeys.UAA);
+        String codeDataString = JsonUtils.writeValueAsString(codeData);
+        when(expiringCodeStore.retrieveCode("thecode", zoneId)).thenReturn(new ExpiringCode("thecode", new Timestamp(1), codeDataString, INVITATION.name()), null);
+        when(expiringCodeStore.generateCode(eq(codeDataString), any(), eq(INVITATION.name()), eq(zoneId))).thenReturn(new ExpiringCode("thenewcode", new Timestamp(1), codeDataString, INVITATION.name()));
+        when(invitationsService.acceptInvitation(anyString(), eq("password"))).thenReturn(new AcceptedInvitation("http://app.example.com/page?first=1&second=2#fragment", user));
+
+        MockHttpServletRequestBuilder post = post("/invitations/accept.do")
+                .param("password", "password")
+                .param("password_confirmation", "password")
+                .param("code", "thecode");
+
+        MvcResult result = mockMvc.perform(post)
+                .andExpect(status().isFound())
+                .andReturn();
+
+        assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), "http://app.example.com/page?first=1&second=2#fragment");
+    }
+
     @Test
     void acceptInviteWithInvalidClientRedirect() throws Exception {
         String zoneId = IdentityZoneHolder.get().getId();
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java
index 1db57d5c24b..787862ee2c4 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsControllerZonePathTest.java
@@ -1,5 +1,6 @@
 package org.cloudfoundry.identity.uaa.invitations;
 
+import java.nio.charset.StandardCharsets;
 import org.cloudfoundry.identity.uaa.authentication.UaaPrincipal;
 import org.cloudfoundry.identity.uaa.authentication.manager.DynamicLdapAuthenticationManager;
 import org.cloudfoundry.identity.uaa.authentication.manager.DynamicZoneAwareAuthenticationManager;
@@ -67,6 +68,9 @@
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
+import org.springframework.web.util.UriUtils;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.INVITATION;
@@ -139,6 +143,15 @@ void tearDown() {
     }
 
     /** Uses context path for ZONE_PATH so request matches ZonePathContextRewritingFilter output. */
+    private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) {
+        UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build();
+        assertThat(redirect.getPath()).endsWith("/login");
+        assertThat(redirect.getFragment()).isNull();
+        assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri");
+        assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("invite_accepted");
+        assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri);
+    }
+
     private static MockHttpServletRequestBuilder requestGet(ZoneRequestPathMode mode, String pathSuffix) {
         if (mode.redirectPrefix().isEmpty()) {
             return get(pathSuffix);
@@ -231,6 +244,7 @@ void acceptInvitePage_for_unverifiedSamlUser(ZoneRequestPathMode mode) throws Ex
 
         assertThat(result.getRequest().getSession().getAttribute("IS_INVITE_ACCEPTANCE")).isEqualTo(true);
         assertThat(result.getRequest().getSession().getAttribute("user_id")).isEqualTo("user-id-001");
+        assertThat(result.getRequest().getSession().getAttribute("invitation_origin")).isEqualTo("test-saml");
     }
 
     @ParameterizedTest
@@ -256,6 +270,7 @@ void acceptInvitePage_for_unverifiedOIDCUser(ZoneRequestPathMode mode) throws Ex
 
         assertThat(result.getRequest().getSession().getAttribute("IS_INVITE_ACCEPTANCE")).isEqualTo(true);
         assertThat(result.getRequest().getSession().getAttribute("user_id")).isEqualTo("user-id-001");
+        assertThat(result.getRequest().getSession().getAttribute("invitation_origin")).isEqualTo("test-oidc");
     }
 
     @ParameterizedTest
@@ -319,6 +334,7 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn(ZoneRequestPathMode mode) thro
 
         ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f");
         invitedUser.setPrimaryEmail("user@example.com");
+        invitedUser.setOrigin(LDAP);
 
         when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser);
         when(invitationsService.acceptInvitation(anyString(), anyString())).thenReturn(new AcceptedInvitation("blah.test.com", new ScimUser()));
@@ -342,6 +358,77 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn(ZoneRequestPathMode mode) thro
         verify(ldapAuthenticationManager).authenticate(any());
     }
 
+    @ParameterizedTest
+    @EnumSource(ZoneRequestPathMode.class)
+    void ldapInviteAcceptanceReissuesCodeWithItsIntent(ZoneRequestPathMode mode) throws Exception {
+        mode.setZone();
+        Map<String, String> codeData = getInvitationsCode(LDAP);
+        String zoneId = IdentityZoneHolder.get().getId();
+        when(expiringCodeStore.retrieveCode("the_secret_code", zoneId)).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name()));
+        when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name()));
+        DynamicLdapAuthenticationManager ldapAuthenticationManager = mock(DynamicLdapAuthenticationManager.class);
+        when(zoneAwareAuthenticationManager.getLdapAuthenticationManager(any(), any())).thenReturn(ldapAuthenticationManager);
+
+        AuthenticationManager ldapActual = mock(AuthenticationManager.class);
+        when(ldapAuthenticationManager.getLdapManagerActual()).thenReturn(ldapActual);
+
+        Authentication auth = mock(Authentication.class);
+        when(auth.isAuthenticated()).thenReturn(true);
+        when(ldapActual.authenticate(any())).thenReturn(auth);
+
+        ExtendedLdapUserDetails extendedLdapUserDetails = mock(ExtendedLdapUserDetails.class);
+
+        when(auth.getPrincipal()).thenReturn(extendedLdapUserDetails);
+        when(extendedLdapUserDetails.getEmailAddress()).thenReturn("user@example.com");
+        when(extendedLdapUserDetails.getUsername()).thenReturn("test-ldap-user");
+
+        ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f");
+        invitedUser.setPrimaryEmail("user@example.com");
+        invitedUser.setOrigin(LDAP);
+
+        when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser);
+        when(invitationsService.acceptInvitation(anyString(), anyString())).thenReturn(new AcceptedInvitation("blah.test.com", new ScimUser()));
+        when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name()));
+
+        String expectedRedirect = mode.redirectPrefix() + "/login?success=invite_accepted&form_redirect_uri=blah.test.com";
+        mockMvc.perform(requestPost(mode, "/invitations/accept_enterprise.do")
+                        .param("enterprise_username", "test-ldap-user")
+                        .param("enterprise_password", "password")
+                        .param("enterprise_email", "email")
+                        .param("code", "the_secret_code"))
+                .andExpect(redirectedUrl(expectedRedirect))
+                .andReturn();
+
+
+        verify(expiringCodeStore, times(1)).generateCode(anyString(), any(), eq(INVITATION.name()), eq(zoneId));
+    }
+
+    @ParameterizedTest
+    @EnumSource(ZoneRequestPathMode.class)
+    void ldapInviteWithWrongIntentIsRejectedBeforeAuthenticationOrMutation(ZoneRequestPathMode mode) throws Exception {
+        mode.setZone();
+        Map<String, String> codeData = getInvitationsCode(LDAP);
+        String zoneId = IdentityZoneHolder.get().getId();
+        when(expiringCodeStore.retrieveCode("the_secret_code", zoneId))
+                .thenReturn(new ExpiringCode(
+                        "code",
+                        new Timestamp(System.currentTimeMillis()),
+                        JsonUtils.writeValueAsString(codeData),
+                        "wrong-intent"));
+
+        mockMvc.perform(requestPost(mode, "/invitations/accept_enterprise.do")
+                        .param("enterprise_username", "test-ldap-user")
+                        .param("enterprise_password", "password")
+                        .param("enterprise_email", "email")
+                        .param("code", "the_secret_code"))
+                .andExpect(status().isUnprocessableEntity())
+                .andExpect(model().attribute("error_message_code", "code_expired"));
+
+        verify(zoneAwareAuthenticationManager, never()).getLdapAuthenticationManager(any(), any());
+        verify(scimUserProvisioning, never()).update(anyString(), any(), anyString());
+        verify(invitationsService, never()).acceptInvitation(anyString(), anyString());
+    }
+
     @ParameterizedTest
     @EnumSource(ZoneRequestPathMode.class)
     void unverifiedLdapUser_acceptsInvite_byLoggingIn_bad_credentials(ZoneRequestPathMode mode) throws Exception {
@@ -359,6 +446,9 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn_bad_credentials(ZoneRequestPat
         Authentication auth = mock(Authentication.class);
         when(auth.isAuthenticated()).thenReturn(true);
         when(ldapActual.authenticate(any())).thenThrow(new BadCredentialsException("bad creds"));
+        ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f");
+        invitedUser.setOrigin(LDAP);
+        when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser);
 
         mockMvc.perform(requestPost(mode, "/invitations/accept_enterprise.do")
                         .param("enterprise_username", "test-ldap-user")
@@ -392,6 +482,7 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn_whereEmailDoesNotMatchAuthenti
 
         ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f");
         invitedUser.setPrimaryEmail("user@example.com");
+        invitedUser.setOrigin(LDAP);
         when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser);
         when(expiringCodeStore.generateCode(anyString(), any(), eq(null), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), null));
 
@@ -411,6 +502,45 @@ void unverifiedLdapUser_acceptsInvite_byLoggingIn_whereEmailDoesNotMatchAuthenti
         verify(ldapActual).authenticate(any());
     }
 
+    @ParameterizedTest
+    @EnumSource(ZoneRequestPathMode.class)
+    void ldapInviteEmailMismatchReissuesCodesWithTheirIntent(ZoneRequestPathMode mode) throws Exception {
+        mode.setZone();
+        Map<String, String> codeData = getInvitationsCode(LDAP);
+        String zoneId = IdentityZoneHolder.get().getId();
+        when(expiringCodeStore.retrieveCode("the_secret_code", zoneId)).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name()));
+        DynamicLdapAuthenticationManager ldapAuthenticationManager = mock(DynamicLdapAuthenticationManager.class);
+        when(zoneAwareAuthenticationManager.getLdapAuthenticationManager(any(), any())).thenReturn(ldapAuthenticationManager);
+
+        AuthenticationManager ldapActual = mock(AuthenticationManager.class);
+        when(ldapAuthenticationManager.getLdapManagerActual()).thenReturn(ldapActual);
+        Authentication auth = mock(Authentication.class);
+        when(ldapActual.authenticate(any())).thenReturn(auth);
+
+        ExtendedLdapUserDetails extendedLdapUserDetails = mock(ExtendedLdapUserDetails.class);
+        when(auth.getPrincipal()).thenReturn(extendedLdapUserDetails);
+        when(extendedLdapUserDetails.getEmailAddress()).thenReturn("different-email@example.com");
+
+        ScimUser invitedUser = new ScimUser("user-id-001", "user@example.com", "g", "f");
+        invitedUser.setPrimaryEmail("user@example.com");
+        invitedUser.setOrigin(LDAP);
+        when(scimUserProvisioning.retrieve("user-id-001", zoneId)).thenReturn(invitedUser);
+        when(expiringCodeStore.generateCode(anyString(), any(), any(), eq(zoneId))).thenReturn(new ExpiringCode("code", new Timestamp(System.currentTimeMillis()), JsonUtils.writeValueAsString(codeData), INVITATION.name()));
+
+        mockMvc.perform(requestPost(mode, "/invitations/accept_enterprise.do")
+                        .param("enterprise_username", "test-ldap-user")
+                        .param("enterprise_password", "password")
+                        .param("enterprise_email", "email")
+                        .param("code", "the_secret_code"))
+                .andExpect(status().isUnprocessableEntity())
+                .andExpect(view().name("invitations/accept_invite"))
+                .andExpect(model().attribute("code", "code"))
+                .andExpect(model().attribute("error_message", "invite.email_mismatch"))
+                .andReturn();
+
+        verify(expiringCodeStore, times(2)).generateCode(anyString(), any(), eq(INVITATION.name()), eq(zoneId));
+    }
+
     @ParameterizedTest
     @EnumSource(ZoneRequestPathMode.class)
     void acceptInvitePage_for_verifiedUser(ZoneRequestPathMode mode) throws Exception {
@@ -496,6 +626,30 @@ void missing_code(ZoneRequestPathMode mode) throws Exception {
         verify(invitationsService, never()).acceptInvitation(anyString(), anyString());
     }
 
+    @ParameterizedTest
+    @EnumSource(ZoneRequestPathMode.class)
+    void acceptInviteWithWrongIntentIsRejectedBeforeCodeRegeneration(ZoneRequestPathMode mode) throws Exception {
+        mode.setZone();
+        MockHttpServletRequestBuilder post = startAcceptInviteFlow(mode, "password", "password");
+        String zoneId = IdentityZoneHolder.get().getId();
+        Map<String, String> codeData = getInvitationsCode(OriginKeys.UAA);
+        when(expiringCodeStore.retrieveCode("thecode", zoneId))
+                .thenReturn(new ExpiringCode(
+                        "thecode",
+                        new Timestamp(System.currentTimeMillis()),
+                        JsonUtils.writeValueAsString(codeData),
+                        "wrong-intent"));
+
+        mockMvc.perform(post)
+                .andExpect(status().isUnprocessableEntity())
+                .andExpect(model().attribute("error_message_code", "code_expired"))
+                .andExpect(view().name("invitations/accept_invite"));
+
+        verify(expiringCodeStore, never()).generateCode(anyString(), any(), any(), eq(zoneId));
+        verify(invitationsService, never()).acceptInvitation(anyString(), anyString());
+        assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
+    }
+
     @ParameterizedTest
     @EnumSource(ZoneRequestPathMode.class)
     void invalid_principal_id(ZoneRequestPathMode mode) throws Exception {
@@ -630,6 +784,36 @@ void acceptInviteWithValidClientRedirect(ZoneRequestPathMode mode) throws Except
                 .andExpect(redirectedUrl(expectedRedirect));
     }
 
+    @ParameterizedTest
+    @EnumSource(ZoneRequestPathMode.class)
+    void acceptInviteKeepsRedirectUrlWithQueryAsOneFormRedirectParameter(ZoneRequestPathMode mode) throws Exception {
+        mode.setZone();
+        String zoneId = IdentityZoneHolder.get().getId();
+        UaaPrincipal uaaPrincipal = new UaaPrincipal("user-id-001", "user@example.com", "user@example.com", OriginKeys.UAA, null, zoneId);
+        ScimUser user = new ScimUser(uaaPrincipal.getId(), uaaPrincipal.getName(), "fname", "lname");
+        user.setPrimaryEmail(user.getUserName());
+
+        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(uaaPrincipal, null, UaaAuthority.USER_AUTHORITIES);
+        SecurityContextHolder.getContext().setAuthentication(token);
+
+        Map<String, String> codeData = getInvitationsCode(OriginKeys.UAA);
+        String codeDataString = JsonUtils.writeValueAsString(codeData);
+        when(expiringCodeStore.retrieveCode("thecode", zoneId)).thenReturn(new ExpiringCode("thecode", new Timestamp(1), codeDataString, INVITATION.name()), null);
+        when(expiringCodeStore.generateCode(eq(codeDataString), any(), eq(INVITATION.name()), eq(zoneId))).thenReturn(new ExpiringCode("thenewcode", new Timestamp(1), codeDataString, INVITATION.name()));
+        when(invitationsService.acceptInvitation(anyString(), eq("password"))).thenReturn(new AcceptedInvitation("http://app.example.com/page?first=1&second=2#fragment", user));
+
+        MockHttpServletRequestBuilder post = requestPost(mode, "/invitations/accept.do")
+                .param("password", "password")
+                .param("password_confirmation", "password")
+                .param("code", "thecode");
+
+        MvcResult result = mockMvc.perform(post)
+                .andExpect(status().isFound())
+                .andReturn();
+
+        assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), "http://app.example.com/page?first=1&second=2#fragment");
+    }
+
     @ParameterizedTest
     @EnumSource(ZoneRequestPathMode.class)
     void acceptInviteWithInvalidClientRedirect(ZoneRequestPathMode mode) throws Exception {
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java
index 732fb7efb76..2e94233f66d 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerTest.java
@@ -3,7 +3,6 @@
 import org.cloudfoundry.identity.uaa.account.AccountCreationService;
 import org.cloudfoundry.identity.uaa.account.AccountsController;
 import org.cloudfoundry.identity.uaa.constants.OriginKeys;
-import org.cloudfoundry.identity.uaa.error.UaaException;
 import org.cloudfoundry.identity.uaa.extensions.PollutionPreventionExtension;
 import org.cloudfoundry.identity.uaa.home.BuildInfo;
 import org.cloudfoundry.identity.uaa.provider.IdentityProvider;
@@ -37,6 +36,8 @@
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
 import java.net.URI;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.Collections;
 
@@ -48,6 +49,7 @@
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.head;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.flash;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.model;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
@@ -115,6 +117,20 @@ void sendActivationEmail() throws Exception {
         Mockito.verify(accountCreationService).beginActivation("user1@example.com", "password", "app", "http://example.com/redirect");
     }
 
+    @Test
+    void sendActivationEmailKeepsTheEmailForTheConfirmationPage() throws Exception {
+        MockHttpServletRequestBuilder post = post("/create_account.do")
+                .param("email", "user1@example.com")
+                .param("password", "password")
+                .param("password_confirmation", "password")
+                .param("client_id", "app");
+
+        mockMvc.perform(post)
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"))
+                .andExpect(flash().attribute("email", "user1@example.com"));
+    }
+
     @Test
     void attemptCreateAccountWithEmailDomainRestriction() throws Exception {
         MockHttpSession session = new MockHttpSession();
@@ -138,9 +154,7 @@ void attemptCreateAccountWithEmailDomainRestriction() throws Exception {
     }
 
     @Test
-    void sendActivationEmailWithUserNameConflict() throws Exception {
-        doThrow(new UaaException("username already exists", 409)).when(accountCreationService).beginActivation("user1@example.com", "password", "app", null);
-
+    void sendActivationEmailForAnExistingAccountRedirectsLikeANewAddress() throws Exception {
         MockHttpServletRequestBuilder post = post("/create_account.do")
                 .param("email", "user1@example.com")
                 .param("password", "password")
@@ -148,9 +162,9 @@ void sendActivationEmailWithUserNameConflict() throws Exception {
                 .param("client_id", "app");
 
         mockMvc.perform(post)
-                .andExpect(status().isUnprocessableEntity())
-                .andExpect(view().name("accounts/new_activation_email"))
-                .andExpect(model().attribute("error_message_code", "username_exists"));
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"))
+                .andExpect(model().attributeDoesNotExist("error_message_code"));
 
         Mockito.verify(accountCreationService).beginActivation("user1@example.com", "password", "app", null);
     }
@@ -177,12 +191,15 @@ void invalidEmail() throws Exception {
                 .param("email", "wrong")
                 .param("password", "password")
                 .param("password_confirmation", "password")
-                .param("client_id", "app");
+                .param("client_id", "app")
+                .param("redirect_uri", "https://client.example.com/callback");
 
         mockMvc.perform(post)
                 .andExpect(status().isUnprocessableEntity())
                 .andExpect(view().name("accounts/new_activation_email"))
-                .andExpect(model().attribute("error_message_code", "invalid_email"));
+                .andExpect(model().attribute("error_message_code", "invalid_email"))
+                .andExpect(model().attribute("client_id", "app"))
+                .andExpect(model().attribute("redirect_uri", "https://client.example.com/callback"));
     }
 
     @Test
@@ -203,30 +220,54 @@ void passwordMismatch() throws Exception {
 
     @Test
     void verifyUser() throws Exception {
-        when(accountCreationService.completeActivation("the_secret_code"))
-                .thenReturn(new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "//example.com/callback"));
+        AccountCreationService.AccountCreationResponse response = new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "//example.com/callback");
+        response.setPasswordResetCode("the_reset_code");
+        when(accountCreationService.completeActivation("the_secret_code")).thenReturn(response);
 
         MockHttpServletRequestBuilder get = get("/verify_user")
                 .param("code", "the_secret_code");
 
         mockMvc.perform(get)
                 .andExpect(status().isFound())
-                .andExpect(redirectedUrl("/login?success=verify_success&form_redirect_uri=//example.com/callback"));
+                .andExpect(redirectedUrl("/reset_password?code=the_reset_code&force_change=true"));
 
         assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
     }
 
+    @Test
+    void verifyUserWithoutResetCodeGoesToLoginAndKeepsTheClientRedirect() throws Exception {
+        AccountCreationService.AccountCreationResponse response = new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "http://example.com/callback?a=1&b=2");
+        when(accountCreationService.completeActivation("the_secret_code")).thenReturn(response);
+        when(accountCreationService.getDefaultRedirect()).thenReturn("home");
+
+        mockMvc.perform(get("/verify_user").param("code", "the_secret_code"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("/login?success=verify_success&form_redirect_uri=" + URLEncoder.encode("http://example.com/callback?a=1&b=2", StandardCharsets.UTF_8)));
+    }
+
+    @Test
+    void verifyUserWithoutResetCodeAndWithTheDefaultRedirectGoesToLogin() throws Exception {
+        AccountCreationService.AccountCreationResponse response = new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "home");
+        when(accountCreationService.completeActivation("the_secret_code")).thenReturn(response);
+        when(accountCreationService.getDefaultRedirect()).thenReturn("home");
+
+        mockMvc.perform(get("/verify_user").param("code", "the_secret_code"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("/login?success=verify_success"));
+    }
+
     @Test
     void verifyUserWithPriorHeadRequest() throws Exception {
-        when(accountCreationService.completeActivation("the_secret_code"))
-                .thenReturn(new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "//example.com/callback"));
+        AccountCreationService.AccountCreationResponse response = new AccountCreationService.AccountCreationResponse("newly-created-user-id", "username", "user@example.com", "//example.com/callback");
+        response.setPasswordResetCode("the_reset_code");
+        when(accountCreationService.completeActivation("the_secret_code")).thenReturn(response);
 
         mockMvc.perform(head("/verify_user").param("code", "the_secret_code"))
                 .andExpect(status().isFound())
                 .andExpect(redirectedUrl("/login"));
         mockMvc.perform(get("/verify_user").param("code", "the_secret_code"))
                 .andExpect(status().isFound())
-                .andExpect(redirectedUrl("/login?success=verify_success&form_redirect_uri=//example.com/callback"));
+                .andExpect(redirectedUrl("/reset_password?code=the_reset_code&force_change=true"));
 
         assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
         Mockito.verify(accountCreationService, times(1)).completeActivation("the_secret_code");
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java
index e0189dff362..2be3caa98c5 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ChangeEmailControllerTest.java
@@ -30,20 +30,24 @@
 import org.springframework.test.context.junit.jupiter.SpringJUnitConfig;
 import org.springframework.test.context.web.WebAppConfiguration;
 import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.MvcResult;
 import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
 import org.springframework.test.web.servlet.setup.MockMvcBuilders;
 import org.springframework.web.context.WebApplicationContext;
 import org.springframework.web.servlet.config.annotation.DefaultServletHandlerConfigurer;
 import org.springframework.web.servlet.config.annotation.EnableWebMvc;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
+import org.springframework.web.util.UriUtils;
 
+import java.nio.charset.StandardCharsets;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.anyString;
-import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
@@ -124,21 +128,19 @@ void changeEmailWithClientIdAndRedirectUri() throws Exception {
     }
 
     @Test
-    void changeEmailWithUsernameConflict() throws Exception {
+    void changeEmailToAnAddressThatHasAnAccountRedirectsLikeAFreeAddress() throws Exception {
         setupSecurityContext();
 
-        doThrow(new UaaException("username already exists", 409)).when(changeEmailService).beginEmailChange("user-id-001", "bob", "new@example.com", "", null);
-
         MockHttpServletRequestBuilder post = post("/change_email.do")
                 .contentType(APPLICATION_FORM_URLENCODED)
                 .param("newEmail", "new@example.com")
                 .param("client_id", "");
 
         mockMvc.perform(post)
-                .andExpect(status().isUnprocessableEntity())
-                .andExpect(view().name("change_email"))
-                .andExpect(model().attribute("error_message_code", "username_exists"))
-                .andExpect(model().attribute("email", "user@example.com"));
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("email_sent?code=email_change"));
+
+        verify(changeEmailService).beginEmailChange("user-id-001", "bob", "new@example.com", "", null);
     }
 
     @Test
@@ -169,13 +171,16 @@ void invalidEmail() throws Exception {
         MockHttpServletRequestBuilder post = post("/change_email.do")
                 .contentType(APPLICATION_FORM_URLENCODED)
                 .param("newEmail", "invalid")
-                .param("client_id", "app");
+                .param("client_id", "app")
+                .param("redirect_uri", "https://client.example.com/callback");
 
         mockMvc.perform(post)
                 .andExpect(status().isUnprocessableEntity())
                 .andExpect(view().name("change_email"))
                 .andExpect(model().attribute("error_message_code", "invalid_email"))
-                .andExpect(model().attribute("email", "user@example.com"));
+                .andExpect(model().attribute("email", "user@example.com"))
+                .andExpect(model().attribute("client_id", "app"))
+                .andExpect(model().attribute("redirect_uri", "https://client.example.com/callback"));
     }
 
     @Test
@@ -241,9 +246,43 @@ void verifyEmailWithRedirectUrl() throws Exception {
                 .contentType(APPLICATION_FORM_URLENCODED)
                 .param("code", "the_secret_code");
 
-        mockMvc.perform(get)
+        MvcResult result = mockMvc.perform(get)
                 .andExpect(status().isFound())
-                .andExpect(redirectedUrl("login?success=change_email_success&form_redirect_uri=//example.com/callback"));
+                .andReturn();
+
+        assertRedirectsToLoginWithSingleFormRedirectUri(result, "//example.com/callback");
+    }
+
+    @Test
+    void verifyEmailKeepsRedirectUrlWithQueryAsOneFormRedirectParameter() throws Exception {
+        UaaUser user = new UaaUser("user-id-001", "new@example.com", "password", "new@example.com", Collections.<GrantedAuthority>emptyList(), "name", "name", null, null, OriginKeys.UAA, null, true, IdentityZoneHolder.get().getId(), "user-id-001", null);
+        when(uaaUserDatabase.retrieveUserById(anyString())).thenReturn(user);
+
+        Map<String, String> response = new HashMap<>();
+        response.put("userId", "user-id-001");
+        response.put("username", "new@example.com");
+        response.put("email", "new@example.com");
+        response.put("redirect_url", "http://app.example.com/page?first=1&second=2#fragment");
+        when(changeEmailService.completeVerification("the_secret_code")).thenReturn(response);
+
+        MockHttpServletRequestBuilder get = get("/verify_email")
+                .contentType(APPLICATION_FORM_URLENCODED)
+                .param("code", "the_secret_code");
+
+        MvcResult result = mockMvc.perform(get)
+                .andExpect(status().isFound())
+                .andReturn();
+
+        assertRedirectsToLoginWithSingleFormRedirectUri(result, "http://app.example.com/page?first=1&second=2#fragment");
+    }
+
+    private static void assertRedirectsToLoginWithSingleFormRedirectUri(MvcResult result, String expectedFormRedirectUri) {
+        UriComponents redirect = UriComponentsBuilder.fromUriString(result.getResponse().getRedirectedUrl()).build();
+        assertThat(redirect.getPath()).isEqualTo("login");
+        assertThat(redirect.getFragment()).isNull();
+        assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri");
+        assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("change_email_success");
+        assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri);
     }
 
     @Test
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java
index eb1e2bde8bc..390bccd3cb2 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/EmailAccountCreationServiceTests.java
@@ -3,10 +3,11 @@
 import org.assertj.core.api.InstanceOfAssertFactories;
 import org.cloudfoundry.identity.uaa.account.AccountCreationService;
 import org.cloudfoundry.identity.uaa.account.EmailAccountCreationService;
+import org.cloudfoundry.identity.uaa.account.ForgotPasswordInfo;
+import org.cloudfoundry.identity.uaa.account.ResetPasswordService;
 import org.cloudfoundry.identity.uaa.codestore.ExpiringCode;
 import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore;
 import org.cloudfoundry.identity.uaa.constants.OriginKeys;
-import org.cloudfoundry.identity.uaa.error.UaaException;
 import org.cloudfoundry.identity.uaa.extensions.PollutionPreventionExtension;
 import org.cloudfoundry.identity.uaa.message.MessageService;
 import org.cloudfoundry.identity.uaa.message.MessageType;
@@ -32,6 +33,7 @@
 import org.mockito.ArgumentCaptor;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.dao.OptimisticLockingFailureException;
 import org.springframework.http.HttpStatus;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.security.core.context.SecurityContextHolder;
@@ -46,15 +48,19 @@
 import java.util.HashMap;
 import java.util.Map;
 
+import static org.assertj.core.api.Assertions.assertThatCode;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType.REGISTRATION;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.Mockito.anyInt;
 import static org.mockito.Mockito.anyString;
 import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.eq;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
@@ -72,6 +78,7 @@ class EmailAccountCreationServiceTests {
     private MultitenantClientServices mockClientDetailsService;
     private ClientDetails mockClientDetails;
     private PasswordValidator mockPasswordValidator;
+    private ResetPasswordService mockResetPasswordService;
     private IdentityZoneManager mockIdentityZoneManager;
     private ScimUser user;
     private ExpiringCode code;
@@ -91,6 +98,7 @@ void setUp() {
         mockClientDetailsService = mock(MultitenantClientServices.class);
         mockClientDetails = mock(ClientDetails.class);
         mockPasswordValidator = mock(PasswordValidator.class);
+        mockResetPasswordService = mock(ResetPasswordService.class);
         mockIdentityZoneManager = mock(IdentityZoneManager.class);
         emailAccountCreationService = initEmailAccountCreationService();
 
@@ -104,6 +112,10 @@ void setUp() {
         currentIdentityZoneId = "zoneId" + randomValueStringGenerator.generate();
 
         when(mockIdentityZoneManager.getCurrentIdentityZoneId()).thenReturn(currentIdentityZoneId);
+
+        ExpiringCode resetCode = new ExpiringCode("reset_password_code", new Timestamp(System.currentTimeMillis()), "{}", "forgot_password_for_id:newly-created-user-id");
+        when(mockResetPasswordService.forgotPassword(anyString(), any(), any()))
+                .thenReturn(new ForgotPasswordInfo("newly-created-user-id", "user@example.com", resetCode));
     }
 
     private EmailAccountCreationService initEmailAccountCreationService() {
@@ -114,6 +126,7 @@ private EmailAccountCreationService initEmailAccountCreationService() {
                 mockScimUserProvisioning,
                 mockClientDetailsService,
                 mockPasswordValidator,
+                mockResetPasswordService,
                 mockIdentityZoneManager
         );
     }
@@ -199,8 +212,19 @@ void beginActivationWithExistingUser() {
                 eq(currentIdentityZoneId))
         ).thenReturn(Collections.singletonList(user));
         when(mockScimUserProvisioning.createUser(any(ScimUser.class), anyString(), eq(currentIdentityZoneId))).thenThrow(new ScimResourceAlreadyExistsException("duplicate"));
+        IdentityZone mockIdentityZone = mock(IdentityZone.class);
+        when(mockIdentityZone.getName()).thenReturn("something");
+        when(mockIdentityZoneManager.getCurrentIdentityZone()).thenReturn(mockIdentityZone);
+
+        assertThatCode(() -> emailAccountCreationService.beginActivation("user@example.com", "password", "login", null)).doesNotThrowAnyException();
 
-        assertThatThrownBy(() -> emailAccountCreationService.beginActivation("user@example.com", "password", "login", null)).asInstanceOf(InstanceOfAssertFactories.throwable(UaaException.class));
+        verify(mockMessageService).sendMessage(
+                eq("user@example.com"),
+                any(MessageType.class),
+                anyString(),
+                anyString()
+        );
+        verify(mockCodeStore, never()).generateCode(anyString(), any(Timestamp.class), anyString(), anyString());
     }
 
     @Test
@@ -258,6 +282,116 @@ void completeActivation() {
         assertThat(accountCreation.getUserId()).isNotNull();
     }
 
+    @Test
+    void completeActivationDiscardsRegistrationPasswordAndRequiresPasswordReset() {
+        setUpForSuccess("");
+        when(mockCodeStore.retrieveCode("the_secret_code", currentIdentityZoneId)).thenReturn(code);
+        when(mockScimUserProvisioning.retrieve(anyString(), eq(currentIdentityZoneId))).thenReturn(user);
+        when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(currentIdentityZoneId))).thenReturn(user);
+        when(mockClientDetailsService.loadClientByClientId(anyString(), anyString())).thenReturn(mockClientDetails);
+
+        AccountCreationService.AccountCreationResponse accountCreation = emailAccountCreationService.completeActivation("the_secret_code");
+
+        ArgumentCaptor<String> passwordCaptor = ArgumentCaptor.forClass(String.class);
+        verify(mockScimUserProvisioning).verifyUserAndSetPassword(
+                eq("newly-created-user-id"),
+                passwordCaptor.capture(),
+                eq(true),
+                eq(currentIdentityZoneId));
+        assertThat(passwordCaptor.getValue()).isNotEqualTo("password");
+
+        // An ownership-bound reset code must be issued so the confirming owner can set their own
+        // password through the link.
+        verify(mockResetPasswordService).forgotPassword(eq("user@example.com"), anyString(), anyString());
+        assertThat(accountCreation.getPasswordResetCode()).isEqualTo("reset_password_code");
+    }
+
+    @Test
+    void completeActivationForACodeFromTheUserApiOnlyVerifiesTheUser() {
+        setUpForSuccess("");
+        Map<String, String> data = new HashMap<>();
+        data.put("user_id", "newly-created-user-id");
+        data.put("email", "user@example.com");
+        data.put("client_id", "login");
+        data.put("user_provisioned", "true");
+        code = new ExpiringCode("the_secret_code", code.getExpiresAt(), JsonUtils.writeValueAsString(data), REGISTRATION.name());
+        when(mockCodeStore.retrieveCode("the_secret_code", currentIdentityZoneId)).thenReturn(code);
+        when(mockScimUserProvisioning.retrieve(anyString(), eq(currentIdentityZoneId))).thenReturn(user);
+        when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(currentIdentityZoneId))).thenReturn(user);
+        when(mockClientDetailsService.loadClientByClientId(anyString(), anyString())).thenReturn(mockClientDetails);
+
+        AccountCreationService.AccountCreationResponse accountCreation = emailAccountCreationService.completeActivation("the_secret_code");
+
+        verify(mockScimUserProvisioning).verifyUser(eq("newly-created-user-id"), anyInt(), eq(currentIdentityZoneId));
+        verify(mockScimUserProvisioning, never()).verifyUserAndSetPassword(anyString(), anyString(), anyBoolean(), anyString());
+        verifyNoInteractions(mockResetPasswordService);
+        assertThat(accountCreation.getPasswordResetCode()).isNull();
+        assertThat(accountCreation.getRedirectLocation()).isEqualTo("home");
+    }
+
+    @Test
+    void completeActivationForAnAlreadyVerifiedAccountKeepsItsPassword() {
+        setUpForSuccess("");
+        user.setVerified(true);
+        when(mockCodeStore.retrieveCode("the_secret_code", currentIdentityZoneId)).thenReturn(code);
+        when(mockScimUserProvisioning.retrieve(anyString(), eq(currentIdentityZoneId))).thenReturn(user);
+        when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(currentIdentityZoneId))).thenReturn(user);
+        when(mockClientDetailsService.loadClientByClientId(anyString(), anyString())).thenReturn(mockClientDetails);
+
+        AccountCreationService.AccountCreationResponse accountCreation = emailAccountCreationService.completeActivation("the_secret_code");
+
+        // Another activation link for the same account stays valid after the account was confirmed.
+        // Opening it must keep the password the owner has set and must not ask for another change.
+        verify(mockScimUserProvisioning, never()).verifyUserAndSetPassword(anyString(), anyString(), anyBoolean(), anyString());
+        verifyNoInteractions(mockResetPasswordService);
+        assertThat(accountCreation.getPasswordResetCode()).isNull();
+    }
+
+    @Test
+    void concurrentActivationThatLosesTheVerificationRaceDoesNotIssueAResetCode() {
+        setUpForSuccess("");
+        ScimUser verifiedUser = new ScimUser(
+                "newly-created-user-id",
+                "user@example.com",
+                "givenName",
+                "familyName");
+        verifiedUser.setPrimaryEmail("user@example.com");
+        verifiedUser.setVerified(true);
+        when(mockCodeStore.retrieveCode("the_secret_code", currentIdentityZoneId)).thenReturn(code);
+        when(mockScimUserProvisioning.retrieve(anyString(), eq(currentIdentityZoneId)))
+                .thenReturn(user, verifiedUser);
+        when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), eq(true), eq(currentIdentityZoneId)))
+                .thenThrow(new OptimisticLockingFailureException("already verified"));
+        when(mockClientDetailsService.loadClientByClientId(anyString(), anyString())).thenReturn(mockClientDetails);
+
+        AccountCreationService.AccountCreationResponse accountCreation =
+                emailAccountCreationService.completeActivation("the_secret_code");
+
+        verifyNoInteractions(mockResetPasswordService);
+        assertThat(accountCreation.getPasswordResetCode()).isNull();
+    }
+
+    @Test
+    void completeActivationForAnExternalUserOnlyVerifiesTheUser() {
+        setUpForSuccess("");
+        user.setOrigin("some-external-origin");
+        when(mockCodeStore.retrieveCode("the_secret_code", currentIdentityZoneId)).thenReturn(code);
+        when(mockScimUserProvisioning.retrieve(anyString(), eq(currentIdentityZoneId))).thenReturn(user);
+        when(mockScimUserProvisioning.verifyUser(anyString(), anyInt(), eq(currentIdentityZoneId))).thenReturn(user);
+        when(mockClientDetailsService.loadClientByClientId(anyString(), anyString())).thenReturn(mockClientDetails);
+
+        AccountCreationService.AccountCreationResponse accountCreation = emailAccountCreationService.completeActivation("the_secret_code");
+
+        // The code carries no marker, as codes issued before the marker existed. The self-service steps
+        // work on accounts of the uaa origin, and the reset code is looked up by username, so for another
+        // origin it could belong to a different account with that username. Only the user from the code is verified.
+        verify(mockScimUserProvisioning).verifyUser(eq("newly-created-user-id"), anyInt(), eq(currentIdentityZoneId));
+        verify(mockScimUserProvisioning, never()).changePassword(anyString(), any(), anyString(), anyString());
+        verify(mockScimUserProvisioning, never()).updatePasswordChangeRequired(anyString(), anyBoolean(), anyString());
+        verifyNoInteractions(mockResetPasswordService);
+        assertThat(accountCreation.getPasswordResetCode()).isNull();
+    }
+
     @Test
     void completeActivation_usesAntPathMatching() {
         setUpForSuccess("http://redirect.uri/");
@@ -381,6 +515,7 @@ private String setUpForSuccess(String userId, String redirectUri) {
 
         when(mockClientDetails.getClientId()).thenReturn("login");
         when(mockClientDetails.getRegisteredRedirectUri()).thenReturn(Collections.singleton("http://example.com/*"));
+        when(mockScimUserProvisioning.verifyUserAndSetPassword(anyString(), anyString(), anyBoolean(), anyString())).thenReturn(user);
         return JsonUtils.writeValueAsString(data);
     }
 
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerTest.java
index 81c16984c5f..2a2ef3aaa6b 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerTest.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerTest.java
@@ -5,6 +5,7 @@
 import org.cloudfoundry.identity.uaa.authentication.UaaAuthentication;
 import org.cloudfoundry.identity.uaa.authentication.UaaPrincipal;
 import org.cloudfoundry.identity.uaa.extensions.PollutionPreventionExtension;
+import org.cloudfoundry.identity.uaa.util.SessionUtils;
 import org.cloudfoundry.identity.uaa.zone.beans.IdentityZoneManagerImpl;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -12,13 +13,16 @@
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.ValueSource;
 import org.springframework.core.io.support.ResourcePropertySource;
+import org.springframework.mock.web.MockHttpSession;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.test.context.junit.jupiter.SpringJUnitConfig;
 import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.test.web.servlet.setup.MockMvcBuilders;
 
+import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
@@ -35,14 +39,16 @@ class ForcePasswordChangeControllerTest extends TestClassNullifier {
 
     private MockMvc mockMvc;
     private ResourcePropertySource mockResourcePropertySource;
+    private ResetPasswordService mockResetPasswordService;
     private UaaAuthentication mockUaaAuthentication;
 
     @BeforeEach
     void beforeEach() {
         mockResourcePropertySource = mock(ResourcePropertySource.class);
+        mockResetPasswordService = mock(ResetPasswordService.class);
         ForcePasswordChangeController controller = new ForcePasswordChangeController(
                 mockResourcePropertySource,
-                mock(ResetPasswordService.class),
+                mockResetPasswordService,
                 new IdentityZoneManagerImpl()
         );
         mockMvc = MockMvcBuilders
@@ -79,6 +85,7 @@ void redirectToLogInIfPasswordIsNotExpired(String url) throws Exception {
     void handleForcePasswordChange(String url) throws Exception {
         mockMvc.perform(
                         post(url)
+                                .session(sessionWithPasswordChangePending())
                                 .param("password", "pwd")
                                 .param("password_confirmation", "pwd")
                                 .contextPath("/uaa"))
@@ -92,20 +99,41 @@ void handleForcePasswordChange(String url) throws Exception {
     void handleForcePasswordChangeWithRedirect(String url) throws Exception {
         mockMvc.perform(
                         post(url)
+                                .session(sessionWithPasswordChangePending())
                                 .param("password", "pwd")
                                 .param("password_confirmation", "pwd"))
                 .andExpect(status().isFound())
                 .andExpect(redirectedUrl("/force_password_change_completed"));
     }
 
+    @ParameterizedTest
+    @ValueSource(strings = {"/force_password_change", "/force_password_change/"})
+    void submitWhenNoPasswordChangeIsPending(String url) throws Exception {
+        mockMvc.perform(
+                        post(url)
+                                .param("password", "pwd")
+                                .param("password_confirmation", "pwd"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("/"));
+        verify(mockResetPasswordService, never()).resetUserPassword(any(), any());
+        verify(mockUaaAuthentication, never()).setAuthenticatedTime(anyLong());
+    }
+
     @ParameterizedTest
     @ValueSource(strings = {"/force_password_change", "/force_password_change/"})
     void passwordAndConfirmAreDifferent(String url) throws Exception {
         when(mockResourcePropertySource.getProperty("force_password_change.form_error")).thenReturn("Passwords must match and not be empty.");
         mockMvc.perform(
                         post(url)
+                                .session(sessionWithPasswordChangePending())
                                 .param("password", "pwd")
                                 .param("password_confirmation", "nopwd"))
                 .andExpect(status().isUnprocessableEntity());
     }
+
+    private static MockHttpSession sessionWithPasswordChangePending() {
+        MockHttpSession session = new MockHttpSession();
+        SessionUtils.setPasswordChangeRequired(session, true);
+        return session;
+    }
 }
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerTest.java
index 72e63ad0263..3b6dec44ec6 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerTest.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerTest.java
@@ -329,8 +329,23 @@ void resetPasswordPageDuplicate() throws Exception {
                 .andExpect(status().isOk())
                 .andExpect(view().name("reset_password"));
         mockMvc.perform(get("/reset_password").param("email", "user@example.com").param("code", code.getCode()))
-                .andExpect(status().isUnprocessableEntity())
-                .andExpect(view().name("forgot_password"));
+                .andExpect(status().isOk())
+                .andExpect(view().name("reset_password"));
+    }
+
+    @Test
+    void resetPasswordPageDoesNotExtendTheCodeLifetime() throws Exception {
+        Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + 60_000);
+        ExpiringCode code = codeStore.generateCode("{\"user_id\" : \"some-user-id\"}", expiresAt, FORGOT_PASSWORD_INTENT_PREFIX + "some-user-id", IdentityZoneHolder.get().getId());
+
+        MvcResult result = mockMvc.perform(get("/reset_password").param("code", code.getCode()))
+                .andExpect(status().isOk())
+                .andReturn();
+
+        String formCode = (String) result.getModelAndView().getModel().get("code");
+        ExpiringCode codeInTheForm = codeStore.peekCode(formCode, IdentityZoneHolder.get().getId());
+        assertThat(codeInTheForm).isNotNull();
+        assertThat(codeInTheForm.getExpiresAt()).isBeforeOrEqualTo(expiresAt);
     }
 
     @Test
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/login/UaaResetPasswordServiceTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/login/UaaResetPasswordServiceTests.java
index 82f94df1aaf..5a9f5fac629 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/login/UaaResetPasswordServiceTests.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/login/UaaResetPasswordServiceTests.java
@@ -2,6 +2,7 @@
 
 import org.assertj.core.api.InstanceOfAssertFactories;
 import org.cloudfoundry.identity.uaa.account.ConflictException;
+import org.cloudfoundry.identity.uaa.account.EmailAccountCreationService;
 import org.cloudfoundry.identity.uaa.account.ForgotPasswordInfo;
 import org.cloudfoundry.identity.uaa.account.NotFoundException;
 import org.cloudfoundry.identity.uaa.account.ResetPasswordService.ResetPasswordResponse;
@@ -25,6 +26,8 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
 import org.mockito.ArgumentCaptor;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.core.io.support.ResourcePropertySource;
@@ -35,6 +38,8 @@
 import java.sql.Timestamp;
 import java.util.Collections;
 import java.util.Date;
+import java.util.Set;
+import java.util.stream.Stream;
 
 import static org.assertj.core.api.Assertions.*;
 import static org.mockito.ArgumentMatchers.any;
@@ -276,6 +281,37 @@ void resetPassword_WhereWildcardsDoNotMatch() {
         assertThat(response.getRedirectUri()).isEqualTo("home");
     }
 
+    @ParameterizedTest
+    @MethodSource("registeredRedirectUrisWithoutTheSignupRedirect")
+    void resetPassword_keepsTheClientSignupRedirect(Set<String> registeredRedirectUris) {
+        ExpiringCode code = setupResetPassword("example", "http://login.example.com/after-signup");
+        UaaClientDetails client = new UaaClientDetails();
+        client.setRegisteredRedirectUri(registeredRedirectUris);
+        client.addAdditionalInformation(EmailAccountCreationService.SIGNUP_REDIRECT_URL, "http://login.example.com/after-signup");
+        when(clientDetailsService.loadClientByClientId("example", currentZoneId)).thenReturn(client);
+
+        ResetPasswordResponse response = uaaResetPasswordService.resetPassword(code, "new_secret");
+
+        assertThat(response.getRedirectUri()).isEqualTo("http://login.example.com/after-signup");
+    }
+
+    static Stream<Set<String>> registeredRedirectUrisWithoutTheSignupRedirect() {
+        return Stream.of(Set.of(), Set.of("http://app.example.com/*"));
+    }
+
+    @Test
+    void resetPassword_doesNotFollowAnUnregisteredRedirectThatIsNotTheSignupRedirect() {
+        ExpiringCode code = setupResetPassword("example", "http://elsewhere.example.com/");
+        UaaClientDetails client = new UaaClientDetails();
+        client.setRegisteredRedirectUri(Collections.singleton("http://app.example.com/*"));
+        client.addAdditionalInformation(EmailAccountCreationService.SIGNUP_REDIRECT_URL, "http://login.example.com/after-signup");
+        when(clientDetailsService.loadClientByClientId("example", currentZoneId)).thenReturn(client);
+
+        ResetPasswordResponse response = uaaResetPasswordService.resetPassword(code, "new_secret");
+
+        assertThat(response.getRedirectUri()).isEqualTo("home");
+    }
+
     @Test
     void resetPassword_WithNoRedirectUri() {
         ExpiringCode code = setupResetPassword("example", "");
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerIT.java b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerIT.java
index 08cdbc34752..7bab1ae2ce0 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerIT.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerIT.java
@@ -44,6 +44,7 @@
 import org.cloudfoundry.identity.uaa.util.JsonUtils;
 import org.cloudfoundry.identity.uaa.util.SessionUtils;
 import org.cloudfoundry.identity.uaa.util.TimeServiceImpl;
+import org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils;
 import org.cloudfoundry.identity.uaa.util.UaaRandomStringUtil;
 import org.cloudfoundry.identity.uaa.util.UaaTokenUtils;
 import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder;
@@ -61,6 +62,7 @@
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.mock.http.client.MockClientHttpRequest;
 import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.InsufficientAuthenticationException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
@@ -1059,6 +1061,50 @@ void invitedUser_becomesVerifiedOnAccept() {
         RequestContextHolder.resetRequestAttributes();
     }
 
+    @Test
+    void invitedUser_isRejectedWhenIdentityProviderDoesNotMatchInvitation() {
+        try {
+            setUpInvitedUser();
+            UaaHttpRequestUtils.setInvitationSessionAttributes("user-id", "other-origin");
+            claims.remove("preferred_username");
+            claims.put("preferred_username", "marissa@bloggs.com");
+            mockToken();
+
+            assertThatThrownBy(() -> externalOAuthAuthenticationManager.authenticate(xCodeToken))
+                    .isInstanceOf(BadCredentialsException.class)
+                    .hasMessageContaining("identity provider does not match");
+
+            ArgumentCaptor<ApplicationEvent> eventCaptor = ArgumentCaptor.forClass(ApplicationEvent.class);
+            verify(publisher, atLeast(0)).publishEvent(eventCaptor.capture());
+            assertThat(eventCaptor.getAllValues()).noneMatch(InvitedUserAuthenticatedEvent.class::isInstance);
+        } finally {
+            RequestContextHolder.resetRequestAttributes();
+        }
+    }
+
+    @Test
+    void invitedVerifiedUser_isRejectedWhenTokenHasNoEmail() {
+        try {
+            setUpInvitedUser(true);
+            assertThat(userDatabase.retrieveUserById("user-id").isVerified()).isTrue();
+            addTheUserOnAuth();
+
+            claims.remove("email");
+            claims.put("preferred_username", "someone-else");
+            mockToken();
+
+            assertThatThrownBy(() -> externalOAuthAuthenticationManager.authenticate(xCodeToken))
+                    .isInstanceOf(BadCredentialsException.class)
+                    .hasMessageContaining("Authenticated email doesn't match invited email");
+
+            ArgumentCaptor<ApplicationEvent> eventCaptor = ArgumentCaptor.forClass(ApplicationEvent.class);
+            verify(publisher, atLeast(0)).publishEvent(eventCaptor.capture());
+            assertThat(eventCaptor.getAllValues()).noneMatch(InvitedUserAuthenticatedEvent.class::isInstance);
+        } finally {
+            RequestContextHolder.resetRequestAttributes();
+        }
+    }
+
     @Test
     void loginAndValidateSignatureUsingTokenKeyEndpoint() throws Exception {
         config.setTokenKeyUrl(URI.create("http://localhost/token_key").toURL());
@@ -1418,10 +1464,15 @@ private void addTheUserOnAuth() {
     }
 
     private void setUpInvitedUser() {
+        setUpInvitedUser(false);
+    }
+
+    private void setUpInvitedUser(boolean verified) {
         UaaUser existingShadowUser = new UaaUser(new UaaUserPrototype()
                 .withUsername("marissa@bloggs.com")
                 .withPassword("")
                 .withEmail("marissa@bloggs.com")
+                .withVerified(verified)
                 .withGivenName("Marissa_Old")
                 .withFamilyName("Bloggs_Old")
                 .withId("user-id")
@@ -1432,9 +1483,8 @@ private void setUpInvitedUser() {
         userDatabase.addUser(existingShadowUser);
 
         RequestAttributes attributes = new ServletRequestAttributes(new MockHttpServletRequest());
-        attributes.setAttribute("IS_INVITE_ACCEPTANCE", true, RequestAttributes.SCOPE_SESSION);
-        attributes.setAttribute("user_id", existingShadowUser.getId(), RequestAttributes.SCOPE_SESSION);
         RequestContextHolder.setRequestAttributes(attributes);
+        UaaHttpRequestUtils.setInvitationSessionAttributes(existingShadowUser.getId(), ORIGIN);
     }
 
     // Asserts that the outgoing request body contains all the given substrings.
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java
index 721e99b4ed7..d93a56d7b07 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/saml/OpenSaml5AuthenticationProviderUaaTests.java
@@ -30,6 +30,7 @@
 import org.cloudfoundry.identity.uaa.user.UserInfo;
 import org.cloudfoundry.identity.uaa.util.TimeService;
 import org.cloudfoundry.identity.uaa.util.TimeServiceImpl;
+import org.cloudfoundry.identity.uaa.util.UaaHttpRequestUtils;
 import org.cloudfoundry.identity.uaa.util.beans.DbUtils;
 import org.cloudfoundry.identity.uaa.web.UaaSavedRequestAwareAuthenticationSuccessHandler;
 import org.cloudfoundry.identity.uaa.zone.IdentityZone;
@@ -508,18 +509,104 @@ void invitedUserAuthenticationWhenAuthenticatedEmailDoesNotMatchInvitedEmail() {
         assertThat(user.isVerified()).isFalse();
     }
 
+    @Test
+    void invitedUserAuthenticationRejectsDifferentIdentityProvider() {
+        ScimUser scimUser = getInvitedUser();
+        UaaHttpRequestUtils.setInvitationSessionAttributes(scimUser.getId(), "other-saml-provider");
+        Map<String, String> userAttributes =
+                getUserAttributes("Marissa-invited", null, "marissa.invited@test.org", null, null);
+        Saml2AuthenticationToken authenticationToken =
+                authenticationToken("marissa-invited", attributeStatements(userAttributes));
+
+        assertThatThrownBy(() -> authenticate(authenticationToken))
+                .isInstanceOf(Saml2AuthenticationException.class)
+                .hasMessageContaining("identity provider does not match");
+
+        UaaUser user = userDatabase.retrieveUserById(scimUser.getId());
+        assertThat(user.isVerified()).isFalse();
+        assertThat(user.getUsername()).isEqualTo("marissa.invited@test.org");
+    }
+
+    @Test
+    void invitedVerifiedUserAuthenticationWhenAssertionHasNoEmail() {
+        Map<String, Object> attributeMappings = new HashMap<>();
+        attributeMappings.put("email", "emailAddress");
+        providerDefinition.setAttributeMappings(attributeMappings);
+        provider.setConfig(providerDefinition);
+        providerProvisioning.update(provider, identityZoneManager.getCurrentIdentityZone().getId());
+
+        ScimUser scimUser = getInvitedUser(true);
+        assertThat(userDatabase.retrieveUserById(scimUser.getId()).isVerified()).isTrue();
+        Map<String, String> userAttributes = getUserAttributes("Marissa-invited", null, null, null, null);
+        Saml2AuthenticationToken authenticationToken = authenticationToken("marissa-invited", attributeStatements(userAttributes));
+
+        assertThatThrownBy(() -> authenticate(authenticationToken))
+                .isInstanceOf(Saml2AuthenticationException.class)
+                .hasMessageContaining("invited user is already verified");
+
+        UaaUser user = userDatabase.retrieveUserById(scimUser.getId());
+        assertThat(user.getUsername()).isEqualTo("marissa.invited@test.org");
+        assertThat(user.getEmail()).isEqualTo("marissa.invited@test.org");
+    }
+
+    @Test
+    void invitedUnverifiedUserWithDifferentUsernameAuthenticationWhenAssertionHasNoEmail() {
+        Map<String, Object> attributeMappings = new HashMap<>();
+        attributeMappings.put("email", "emailAddress");
+        providerDefinition.setAttributeMappings(attributeMappings);
+        provider.setConfig(providerDefinition);
+        providerProvisioning.update(provider, identityZoneManager.getCurrentIdentityZone().getId());
+
+        ScimUser scimUser = getInvitedUser(false, "marissa-existing");
+        assertThat(userDatabase.retrieveUserById(scimUser.getId()).isVerified()).isFalse();
+        Map<String, String> userAttributes = getUserAttributes("Marissa-invited", null, null, null, null);
+        Saml2AuthenticationToken authenticationToken = authenticationToken("marissa-invited", attributeStatements(userAttributes));
+
+        assertThatThrownBy(() -> authenticate(authenticationToken))
+                .isInstanceOf(Saml2AuthenticationException.class)
+                .hasMessageContaining("username differs from the invited email");
+
+        UaaUser user = userDatabase.retrieveUserById(scimUser.getId());
+        assertThat(user.getUsername()).isEqualTo("marissa-existing");
+        assertThat(user.getEmail()).isEqualTo("marissa.invited@test.org");
+    }
+
+    @Test
+    void invitedUnverifiedUserAuthenticationWhenAssertionHasNoEmail() {
+        Map<String, Object> attributeMappings = new HashMap<>();
+        attributeMappings.put("email", "emailAddress");
+        providerDefinition.setAttributeMappings(attributeMappings);
+        provider.setConfig(providerDefinition);
+        providerProvisioning.update(provider, identityZoneManager.getCurrentIdentityZone().getId());
+
+        ScimUser scimUser = getInvitedUser(false);
+        Map<String, String> userAttributes = getUserAttributes("Marissa-invited", null, null, null, null);
+        authenticate(authenticationToken("marissa-invited", attributeStatements(userAttributes)));
+
+        UaaUser user = userDatabase.retrieveUserById(scimUser.getId());
+        assertThat(user.getUsername()).isEqualTo("marissa-invited");
+        assertThat(user.getEmail()).isEqualTo("marissa.invited@test.org");
+    }
+
     private ScimUser getInvitedUser() {
-        ScimUser invitedUser = new ScimUser(null, "marissa.invited@test.org", "Marissa", "Bloggs");
-        invitedUser.setVerified(false);
+        return getInvitedUser(false);
+    }
+
+    private ScimUser getInvitedUser(boolean verified) {
+        return getInvitedUser(verified, "marissa.invited@test.org");
+    }
+
+    private ScimUser getInvitedUser(boolean verified, String username) {
+        ScimUser invitedUser = new ScimUser(null, username, "Marissa", "Bloggs");
+        invitedUser.setVerified(verified);
         invitedUser.setPrimaryEmail("marissa.invited@test.org");
         invitedUser.setOrigin(OriginKeys.UAA);
         ScimUser scimUser = userProvisioning.createUser(invitedUser, "getInvitedUser-password",
                 identityZoneManager.getCurrentIdentityZone().getId());
 
         RequestAttributes attributes = new ServletRequestAttributes(new MockHttpServletRequest());
-        attributes.setAttribute("IS_INVITE_ACCEPTANCE", true, RequestAttributes.SCOPE_SESSION);
-        attributes.setAttribute("user_id", scimUser.getId(), RequestAttributes.SCOPE_SESSION);
         RequestContextHolder.setRequestAttributes(attributes);
+        UaaHttpRequestUtils.setInvitationSessionAttributes(scimUser.getId(), OriginKeys.SAML);
 
         return scimUser;
     }
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioningTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioningTests.java
index cacbec3094b..fc92cbcda37 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioningTests.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/scim/jdbc/JdbcScimUserProvisioningTests.java
@@ -1139,6 +1139,41 @@ void updatedUserVerified() {
         assertThat(verified).isTrue();
     }
 
+    @Test
+    void verifyUserAndSetPasswordOnlyUpdatesAnUnverifiedUser() {
+        String userId = createUserForDelete(jdbcTemplate, currentIdentityZoneId);
+
+        ScimUser activatedUser =
+                jdbcScimUserProvisioning.verifyUserAndSetPassword(userId, "activation-password", true, currentIdentityZoneId);
+
+        assertThat(activatedUser.isVerified()).isTrue();
+        assertThat(jdbcScimUserProvisioning.checkPasswordMatches(userId, "activation-password", currentIdentityZoneId)).isTrue();
+        assertThat(jdbcScimUserProvisioning.checkPasswordChangeIndividuallyRequired(userId, currentIdentityZoneId)).isTrue();
+
+        jdbcScimUserProvisioning.changePassword(userId, null, "owner-password", currentIdentityZoneId);
+        jdbcScimUserProvisioning.updatePasswordChangeRequired(userId, false, currentIdentityZoneId);
+
+        assertThatThrownBy(() ->
+                jdbcScimUserProvisioning.verifyUserAndSetPassword(userId, "late-activation-password", true, currentIdentityZoneId))
+                .isInstanceOf(OptimisticLockingFailureException.class);
+        assertThat(jdbcScimUserProvisioning.checkPasswordMatches(userId, "owner-password", currentIdentityZoneId)).isTrue();
+        assertThat(jdbcScimUserProvisioning.checkPasswordChangeIndividuallyRequired(userId, currentIdentityZoneId)).isFalse();
+    }
+
+    @Test
+    void verifyUserAndSetPasswordCanLeavePasswordChangeNotRequired() {
+        String userId = createUserForDelete(jdbcTemplate, currentIdentityZoneId);
+
+        jdbcScimUserProvisioning.verifyUserAndSetPassword(
+                userId,
+                "invitation-password",
+                false,
+                currentIdentityZoneId);
+
+        assertThat(jdbcScimUserProvisioning.checkPasswordMatches(userId, "invitation-password", currentIdentityZoneId)).isTrue();
+        assertThat(jdbcScimUserProvisioning.checkPasswordChangeIndividuallyRequired(userId, currentIdentityZoneId)).isFalse();
+    }
+
     @Test
     void createUserWithNoZoneDefaultsToUAAZone() {
         String id = UUID.randomUUID().toString();
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandlerTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandlerTests.java
index 92152cbaca0..f72961d2e31 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandlerTests.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandlerTests.java
@@ -79,6 +79,19 @@ void invalidFormRedirectIsNotReturned() {
         assertThat(handler.determineTargetUrl(request, new MockHttpServletResponse())).isEqualTo("/");
     }
 
+    @Test
+    void serverValidatedRedirectAllowsOffHostTargetAndIsConsumed() {
+        String redirectUri = "https://client.example.com/callback";
+        HttpSession session = request.getSession();
+        session.setAttribute(SPRING_SECURITY_SAVED_REQUEST, mock(SavedRequest.class));
+
+        UaaSavedRequestAwareAuthenticationSuccessHandler.saveTrustedRedirect(session, redirectUri);
+
+        assertThat(session.getAttribute(SPRING_SECURITY_SAVED_REQUEST)).isNull();
+        assertThat(handler.determineTargetUrl(request, new MockHttpServletResponse())).isEqualTo(redirectUri);
+        assertThat(handler.determineTargetUrl(request, new MockHttpServletResponse())).isEqualTo("/");
+    }
+
     @Test
     void onAuthenticationSuccess_noSavedRequest_hasRelayStateUrl_notWhitelisted() throws Exception {
         String redirectUri = "https://test.com/test2";
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilterZonePathTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilterZonePathTests.java
index 2c91697f8f9..4535ad6e2c5 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilterZonePathTests.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/zone/IdentityZoneResolvingFilterZonePathTests.java
@@ -171,6 +171,86 @@ void pathSubdomainAndDefaultZoneHost_continuesWithPathSubdomain() throws Excepti
             assertThat(chainInvoked.get()).isTrue();
             assertThat(zoneInHolderWhenChainInvoked.get().getSubdomain()).isEqualTo("pathzone");
         }
+
+        @Test
+        void defaultPathAndHostSubdomain_returns400() throws Exception {
+            request.setAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH, "");
+            request.setServerName("hostzone." + ROOT_HOST);
+            filter.setDefaultInternalHostnames(Collections.singleton(ROOT_HOST));
+
+            filter.doFilter(request, response, chainThatCapturesHolder());
+
+            assertThat(response.getStatus()).isEqualTo(MockHttpServletResponse.SC_BAD_REQUEST);
+            assertThat(response.getErrorMessage()).isEqualTo("Cannot use both subdomain and zone path");
+            assertThat(chainInvoked.get()).isFalse();
+        }
+
+        @Test
+        void defaultPathAndDefaultZoneHost_continuesWithDefaultZone() throws Exception {
+            request.setAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH, "");
+            request.setServerName(ROOT_HOST);
+            filter.setDefaultInternalHostnames(Collections.singleton(ROOT_HOST));
+            IdentityZone uaaZone = IdentityZone.getUaa();
+            when(dao.retrieveBySubdomain(eq(""))).thenReturn(uaaZone);
+
+            filter.doFilter(request, response, chainThatCapturesHolder());
+
+            assertThat(response.getStatus()).isEqualTo(MockHttpServletResponse.SC_OK);
+            assertThat(chainInvoked.get()).isTrue();
+            assertThat(zoneInHolderWhenChainInvoked.get()).isEqualTo(uaaZone);
+        }
+    }
+
+    // ---------- Path-based: the host must still be recognized when root domains are configured ----------
+
+    @Nested
+    class PathBasedWithUnrecognizedHost {
+
+        @Test
+        void hostDoesNotMatchAnyRoot_returns404() throws Exception {
+            filter.setDefaultInternalHostnames(Collections.singleton(ROOT_HOST));
+            request.setAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH, "myzone");
+            request.setServerName("some.other.domain.com");
+            when(dao.retrieveBySubdomain(eq("myzone"))).thenReturn(MultitenancyFixture.identityZone("zone-id", "myzone"));
+
+            filter.doFilter(request, response, chainThatCapturesHolder());
+
+            assertThat(response.getStatus()).isEqualTo(MockHttpServletResponse.SC_NOT_FOUND);
+            assertThat(response.getErrorMessage()).contains("some.other.domain.com");
+            assertThat(request.getAttribute("error_message_code")).isEqualTo("zone.not.found");
+            assertThat(chainInvoked.get()).isFalse();
+            verifyNoInteractions(dao);
+        }
+
+        @Test
+        void staticResource_hostDoesNotMatchAnyRoot_continuesChain() throws Exception {
+            filter.setDefaultInternalHostnames(Collections.singleton(ROOT_HOST));
+            request.setAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH, "myzone");
+            request.setServerName("some.other.domain.com");
+            request.setContextPath("");
+            request.setRequestURI("/resources/css/app.css");
+            request.setServletPath("/resources/css/app.css");
+
+            filter.doFilter(request, response, chainThatCapturesHolder());
+
+            assertThat(response.getStatus()).isEqualTo(MockHttpServletResponse.SC_OK);
+            assertThat(chainInvoked.get()).isTrue();
+        }
+
+        @Test
+        void onlyLocalhostConfigured_acceptsAnyHost() throws Exception {
+            filter.setDefaultInternalHostnames(Collections.singleton("localhost"));
+            request.setAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH, "myzone");
+            request.setServerName("some.other.domain.com");
+            IdentityZone zone = MultitenancyFixture.identityZone("zone-id", "myzone");
+            when(dao.retrieveBySubdomain(eq("myzone"))).thenReturn(zone);
+
+            filter.doFilter(request, response, chainThatCapturesHolder());
+
+            assertThat(response.getStatus()).isEqualTo(MockHttpServletResponse.SC_OK);
+            assertThat(chainInvoked.get()).isTrue();
+            assertThat(zoneInHolderWhenChainInvoked.get().getSubdomain()).isEqualTo("myzone");
+        }
     }
 
     // ---------- Hostname-based: zone resolution ----------
@@ -242,6 +322,7 @@ void hostDoesNotMatchAnyRoot_returns404() throws Exception {
             filter.doFilter(request, response, chainThatCapturesHolder());
 
             assertThat(response.getStatus()).isEqualTo(MockHttpServletResponse.SC_NOT_FOUND);
+            assertThat(response.getErrorMessage()).contains("some.other.domain.com");
             assertThat(request.getAttribute("error_message_code")).isEqualTo("zone.not.found");
             assertThat(chainInvoked.get()).isFalse();
             verifyNoInteractions(dao);
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilterTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilterTests.java
index 20b97272aca..9f81fd98cdd 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilterTests.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilterTests.java
@@ -109,7 +109,7 @@ void pathWithEmptySubdomainSegment_rejectsWithBadRequest() throws Exception {
     }
 
     @Test
-    void pathWithDefaultZonePrefix_withContextPath_rewritesToIncludeZonePathAndDoesNotSetZoneSubdomainFromPath() throws Exception {
+    void pathWithDefaultZonePrefix_withContextPath_rewritesAndSelectsDefaultZone() throws Exception {
         request.setContextPath("/uaa");
         request.setRequestURI("/uaa" + ZONE_PATH_PREFIX + DEFAULT_ZONE_SUBDOMAIN_PATH + "/login");
         request.setServerName("localhost");
@@ -125,12 +125,12 @@ void pathWithDefaultZonePrefix_withContextPath_rewritesToIncludeZonePathAndDoesN
         assertThat(passed.getServletPath()).isEqualTo("/login");
         assertThat(passed.getRequestURI()).isEqualTo("/uaa/z/" + DEFAULT_ZONE_SUBDOMAIN_PATH + "/login");
         assertThat(passed.getPathInfo()).isNull();
-        assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isNull();
+        assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isEqualTo("");
         assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_ORIGINAL_CONTEXT_PATH)).isEqualTo("/uaa");
     }
 
     @Test
-    void pathWithDefaultZonePrefix_withoutContextPath_rewritesToIncludeZonePathAndDoesNotSetZoneSubdomainFromPath() throws Exception {
+    void pathWithDefaultZonePrefix_withoutContextPath_rewritesAndSelectsDefaultZone() throws Exception {
         request.setContextPath("");
         request.setRequestURI(ZONE_PATH_PREFIX + DEFAULT_ZONE_SUBDOMAIN_PATH + "/login");
         request.setServerName("localhost");
@@ -144,7 +144,7 @@ void pathWithDefaultZonePrefix_withoutContextPath_rewritesToIncludeZonePathAndDo
         assertThat(passed.getContextPath()).isEqualTo("/z/" + DEFAULT_ZONE_SUBDOMAIN_PATH);
         assertThat(passed.getServletPath()).isEqualTo("/login");
         assertThat(passed.getRequestURI()).isEqualTo("/z/" + DEFAULT_ZONE_SUBDOMAIN_PATH + "/login");
-        assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isNull();
+        assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isEqualTo("");
         assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_ORIGINAL_CONTEXT_PATH)).isEqualTo("");
     }
 
@@ -160,7 +160,7 @@ void pathWithDefaultZonePrefix_DEFAULT_caseInsensitive_rewritesSameAsLowercase()
         assertThat(passed.getContextPath()).isEqualTo("/uaa/z/" + DEFAULT_ZONE_SUBDOMAIN_PATH);
         assertThat(passed.getServletPath()).isEqualTo("/profile");
         assertThat(passed.getRequestURI()).isEqualTo("/uaa/z/" + DEFAULT_ZONE_SUBDOMAIN_PATH + "/profile");
-        assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isNull();
+        assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isEqualTo("");
     }
 
     @Test
@@ -176,7 +176,7 @@ void pathWithDefaultZonePrefix_trailingSlash_rewritesWithServletPathEmptyAndPath
         assertThat(passed.getServletPath()).isEmpty();
         assertThat(passed.getPathInfo()).isEqualTo("/");
         assertThat(passed.getRequestURI()).isEqualTo("/uaa/z/" + DEFAULT_ZONE_SUBDOMAIN_PATH + "/");
-        assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isNull();
+        assertThat(passed.getAttribute(ZonePathContextRewritingFilter.ZONE_SUBDOMAIN_FROM_PATH)).isEqualTo("");
     }
 
     @Test
diff --git a/server/src/test/resources/messages.properties b/server/src/test/resources/messages.properties
index 4ab272636fb..2d90f1a257b 100644
--- a/server/src/test/resources/messages.properties
+++ b/server/src/test/resources/messages.properties
@@ -32,3 +32,4 @@ INSUFFICIENT_CHARACTERISTICS=Password matches %1$s of %3$s character rules, but
 SOURCE_VIOLATION=Password cannot be the same as your %1$s password.
 TOO_LONG=Password must be no more than %2$s characters in length.
 TOO_SHORT=Password must be at least %1$s characters in length.
+email_sent.activation_address=Please check {0} for an activation link.
diff --git a/uaa/slateCustomizations/source/index.html.md.erb b/uaa/slateCustomizations/source/index.html.md.erb
index 9332b0d65e4..684df7ec37f 100644
--- a/uaa/slateCustomizations/source/index.html.md.erb
+++ b/uaa/slateCustomizations/source/index.html.md.erb
@@ -2182,6 +2182,12 @@ _Response Fields_
 
 <%= render('InvitationsEndpointDocs/inviteUsers/response-fields.md') %>
 
+An email address that belongs to a user who is already verified is invited like any other address by default. When the
+server sets `scim.invite.allow_reinvite: false` and the token has `scim.invite` but may not read users (`GET /Users`
+would refuse it, for example because it has neither `scim.read` nor the zone administrator scope), the address is listed
+under `failed_invites` with the error code `user.already-verified`, without a `userId` or an `inviteLink`, and no
+invitation is created. Users who are not verified yet and new users are always invited.
+
 | Error Code | Description                                                           |
 |------------|-----------------------------------------------------------------------|
 | 403        | Forbidden - Insufficient scope                                        |
@@ -2986,6 +2992,35 @@ _Request Parameters_
 
 <%= render('LoginInfoEndpointDocs/perform_auto_login/query-parameters.md') %>
 
+# Expiring Codes
+
+## Create a Code
+
+`POST /Codes` stores a one time code with an expiry and an intent, and returns the generated code. A code can be read back
+once with `GET /Codes/{code}`; reading it removes it. Codes are stored per identity zone.
+
+The `intent` is required and must not be blank; a request without one is rejected with `400 Bad Request` and the message
+`intent is required. Known intents: EMAIL, INVITATION, REGISTRATION; custom values are accepted.`
+The UAA flows only accept a code whose intent matches the flow: `EMAIL` for email change verification, `INVITATION` for
+invitation acceptance and `REGISTRATION` for account activation. Any other value is stored as given and is meant for codes
+that your own application creates and redeems.
+
+<%= render('CodeStoreEndpointDocs/document_create_code/curl-request.md') %>
+<%= render('CodeStoreEndpointDocs/document_create_code/http-request.md') %>
+<%= render('CodeStoreEndpointDocs/document_create_code/http-response.md') %>
+
+_Request Headers_
+
+<%= render('CodeStoreEndpointDocs/document_create_code/request-headers.md') %>
+
+_Request Body_
+
+<%= render('CodeStoreEndpointDocs/document_create_code/request-fields.md') %>
+
+_Response Body_
+
+<%= render('CodeStoreEndpointDocs/document_create_code/response-fields.md') %>
+
 # External Login Server
 
 The UAA provides endpoints that facilitate the use of an external login server. A server that handles the UI
diff --git a/uaa/src/main/resources/messages.properties b/uaa/src/main/resources/messages.properties
index 8cac851020c..1a1749c7828 100644
--- a/uaa/src/main/resources/messages.properties
+++ b/uaa/src/main/resources/messages.properties
@@ -24,9 +24,9 @@ email_change.success=Email address successfully verified.
 email_change.non-uaa-origin=Sorry, your email cannot be changed from here.
 email_change.invalid_email=Please enter a valid email address.
 email_change.invalid_code=Your verification link has expired. Please request another.
-email_change.username_exists=There is already a user with that email address.
 email_sent.email_change=Please check your email for a verification link.
 email_sent.activation=Please check email for an activation link.
+email_sent.activation_address=Please check {0} for an activation link.
 email_sent.reset_password=Please check your email for a reset password link.
 account_activation.form_error=Passwords must match and not be empty.
 account_activation.code_expired=Your invitation code has expired. Please request another.
@@ -39,6 +39,7 @@ change_password.unauthorized=Please enter a valid current password.
 forgot_password.form_error=Please enter a valid email address.
 forgot_password.bad_code=Sorry, your reset password link is no longer valid. You can request another one below.
 reset_password.form_error=Passwords must match and not be empty.
+reset_password.force_change=A password change is required due to changes in the system. Please set a new password.
 create_account.form_error=Passwords must match and not be empty.
 create_account.other_idp=Account sign-up is not required for this email domain. Please login with the identity provider
 force_password_change.form_error=Passwords must match and not be empty.
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/CreateAccountIT.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/CreateAccountIT.java
index e0db98e33e7..3f785a02a57 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/CreateAccountIT.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/CreateAccountIT.java
@@ -87,7 +87,7 @@ void userInitiatedSignup() throws Exception {
         assertThat(body).contains("Activate your account");
 
         assertThat(webDriver.findElement(By.tagName("h1")).getText()).isEqualTo("Create your account");
-        assertThat(webDriver.findElement(By.cssSelector(".instructions-sent")).getText()).isEqualTo("Please check email for an activation link.");
+        assertThat(webDriver.findElement(By.cssSelector(".instructions-sent")).getText()).isEqualTo("Please check " + userEmail + " for an activation link.");
 
         String link = testClient.extractLink(body);
         assertThat(link).isNotEmpty()
@@ -95,8 +95,14 @@ void userInitiatedSignup() throws Exception {
                 .doesNotContain("%40");
 
         webDriver.get(link);
-        assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).doesNotContain("Where to?");
+        // Confirming the account lands on the forced password-set page, not a sign-in page.
+        assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).isEqualTo("Reset Password");
 
+        webDriver.findElement(By.name("password")).sendKeys(SECRET);
+        webDriver.findElement(By.name("password_confirmation")).sendKeys(SECRET);
+        webDriver.clickAndWait(By.xpath("//input[@value='Create new password']"));
+
+        // The owner can now sign in with the password they set.
         webDriver.findElement(By.name("username")).sendKeys(userEmail);
         webDriver.findElement(By.name("password")).sendKeys(SECRET);
         webDriver.clickAndWait(By.xpath("//input[@value='Sign in']"));
@@ -104,6 +110,40 @@ void userInitiatedSignup() throws Exception {
         assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).contains("Where to?");
     }
 
+    @Test
+    void confirmationDoesNotActivateTheRegistrationFormPassword() throws Exception {
+        String registrationPassword = SECRET;
+        String ownerPassword = "0wnerPass";
+
+        int receivedEmailSize = greenMail.getReceivedMessages().length;
+        String userEmail = startCreateUserFlow(registrationPassword);
+
+        greenMail.waitForIncomingEmail(5000, receivedEmailSize + 1);
+        MimeMessage message = greenMail.getReceivedMessages()[receivedEmailSize];
+        String link = testClient.extractLink(GreenMailUtil.getBody(message));
+
+        webDriver.get(link);
+        // Confirmation requires the owner to establish their own password through the link.
+        assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).isEqualTo("Reset Password");
+        webDriver.findElement(By.name("password")).sendKeys(ownerPassword);
+        webDriver.findElement(By.name("password_confirmation")).sendKeys(ownerPassword);
+        webDriver.clickAndWait(By.xpath("//input[@value='Create new password']"));
+
+        // The password typed on the registration form must not grant access.
+        webDriver.get(baseUrl + "/login");
+        webDriver.findElement(By.name("username")).sendKeys(userEmail);
+        webDriver.findElement(By.name("password")).sendKeys(registrationPassword);
+        webDriver.clickAndWait(By.xpath("//input[@value='Sign in']"));
+        assertThat(webDriver.findElement(By.className("alert-error")).getText()).contains("Provided credentials are invalid. Please try again.");
+
+        // Only the password the owner set through the link works.
+        webDriver.get(baseUrl + "/login");
+        webDriver.findElement(By.name("username")).sendKeys(userEmail);
+        webDriver.findElement(By.name("password")).sendKeys(ownerPassword);
+        webDriver.clickAndWait(By.xpath("//input[@value='Sign in']"));
+        assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).contains("Where to?");
+    }
+
     @Test
     void clientInitiatedSignup() throws Exception {
         String userEmail = "user" + new SecureRandom().nextInt() + "@example.com";
@@ -124,14 +164,20 @@ void clientInitiatedSignup() throws Exception {
         assertThat(message.getHeader("To")[0]).isEqualTo(userEmail);
         assertThat(GreenMailUtil.getBody(message)).contains("Activate your account");
 
-        assertThat(webDriver.findElement(By.cssSelector(".instructions-sent")).getText()).isEqualTo("Please check email for an activation link.");
+        assertThat(webDriver.findElement(By.cssSelector(".instructions-sent")).getText()).isEqualTo("Please check " + userEmail + " for an activation link.");
 
         String link = testClient.extractLink(GreenMailUtil.getBody(message));
         assertThat(link).isNotEmpty();
 
         webDriver.get(link);
-        assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).doesNotContain("Where to?");
+        // Confirming the account lands on the forced password-set page, not a sign-in page.
+        assertThat(webDriver.findElement(By.cssSelector("h1")).getText()).isEqualTo("Reset Password");
+
+        webDriver.findElement(By.name("password")).sendKeys(SECRET);
+        webDriver.findElement(By.name("password_confirmation")).sendKeys(SECRET);
+        webDriver.clickAndWait(By.xpath("//input[@value='Create new password']"));
 
+        // The owner can now sign in with the password they set.
         webDriver.findElement(By.name("username")).sendKeys(userEmail);
         webDriver.findElement(By.name("password")).sendKeys(SECRET);
         webDriver.clickAndWait(By.xpath("//input[@value='Sign in']"));
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/InvitationsIT.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/InvitationsIT.java
index a497084e162..7bfd956791c 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/InvitationsIT.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/InvitationsIT.java
@@ -117,7 +117,7 @@ public static String createInvitation(String baseUrl, String username, String us
         invitationHeaders.add("Authorization", "Bearer " + loginToken);
 
         Timestamp expiry = new Timestamp(System.currentTimeMillis() + TimeUnit.MILLISECONDS.convert(System.currentTimeMillis() + 24 * 3600, TimeUnit.MILLISECONDS));
-        ExpiringCode expiringCode = new ExpiringCode(null, expiry, "{\"origin\":\"" + origin + "\", \"client_id\":\"app\", \"redirect_uri\":\"" + redirectUri + "\", \"user_id\":\"" + userId + "\", \"email\":\"" + userEmail + "\"}", null);
+        ExpiringCode expiringCode = new ExpiringCode(null, expiry, "{\"origin\":\"" + origin + "\", \"client_id\":\"app\", \"redirect_uri\":\"" + redirectUri + "\", \"user_id\":\"" + userId + "\", \"email\":\"" + userEmail + "\"}", "INVITATION");
         HttpEntity<ExpiringCode> expiringCodeRequest = new HttpEntity<>(expiringCode, invitationHeaders);
         ResponseEntity<ExpiringCode> expiringCodeResponse = uaaTemplate.exchange(baseUrl + "/Codes", POST, expiringCodeRequest, ExpiringCode.class);
         expiringCode = expiringCodeResponse.getBody();
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/ResetPasswordIT.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/ResetPasswordIT.java
index a59671fefb5..f422778e27f 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/ResetPasswordIT.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/feature/ResetPasswordIT.java
@@ -16,6 +16,8 @@
 import com.icegreen.greenmail.util.GreenMail;
 import com.icegreen.greenmail.util.GreenMailUtil;
 import jakarta.mail.internet.MimeMessage;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
 import org.cloudfoundry.identity.uaa.client.UaaClientDetails;
 import org.cloudfoundry.identity.uaa.integration.util.IntegrationTestUtils;
 import org.cloudfoundry.identity.uaa.login.test.UnlessProfileActive;
@@ -33,6 +35,9 @@
 
 import java.security.SecureRandom;
 import java.util.Collections;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
+import org.springframework.web.util.UriUtils;
 
 import static org.apache.commons.lang3.StringUtils.contains;
 import static org.assertj.core.api.Assertions.assertThat;
@@ -116,33 +121,23 @@ void resettingAPasswordWithPrimaryEmail() {
 
     @Test
     void resetPassword_with_clientRedirect() throws Exception {
-        webDriver.get(baseUrl + "/forgot_password?client_id=" + scimClientId + "&redirect_uri=http://testzonedoesnotexist.localhost");
-        assertThat(webDriver.findElement(By.tagName("h1")).getText()).isEqualTo("Reset Password");
-
-        int receivedEmailSize = greenMail.getReceivedMessages().length;
-
-        webDriver.findElement(By.name("username")).sendKeys(username);
-        webDriver.clickAndWait(By.xpath("//input[@value='Send reset password link']"));
-        assertThat(webDriver.findElement(By.tagName("h1")).getText()).isEqualTo("Instructions Sent");
+        String finalUrl = resetPasswordWithClientRedirect(scimClientId, "http://testzonedoesnotexist.localhost");
 
-        greenMail.waitForIncomingEmail(5000, receivedEmailSize + 1);
-        assertThat(greenMail.getReceivedMessages()).hasSize(receivedEmailSize + 1);
-        MimeMessage message = greenMail.getReceivedMessages()[receivedEmailSize];
-        assertThat(message.getHeader("To")[0]).isEqualTo(email);
-        assertThat(GreenMailUtil.getBody(message)).contains("Reset your password");
-
-        assertThat(webDriver.findElement(By.cssSelector(".instructions-sent")).getText()).isEqualTo("Please check your email for a reset password link.");
+        assertRedirectsToLoginWithSingleFormRedirectUri(finalUrl, "http://testzonedoesnotexist.localhost");
+    }
 
-        String link = testClient.extractLink(GreenMailUtil.getBody(message));
-        assertThat(contains(link, "@")).isFalse();
-        assertThat(contains(link, "%40")).isFalse();
-        webDriver.get(link);
+    @Test
+    void resetPassword_keepsClientRedirectWithQueryAsOneFormRedirectParameter() throws Exception {
+        String redirectUri = "http://testzonedoesnotexist.localhost/page?first=1&second=2#fragment";
+        String adminAccessToken = testClient.getOAuthAccessToken("admin", "adminsecret", "client_credentials", "clients.read clients.write clients.secret clients.admin");
+        String patternClientId = "pattern_" + new SecureRandom().nextInt();
+        UaaClientDetails patternClient = new UaaClientDetails(patternClientId, "oauth", "uaa.user", "authorization_code,refresh_token", null, "http://testzonedoesnotexist.localhost/**");
+        patternClient.setClientSecret("scimsecret");
+        IntegrationTestUtils.createClient(adminAccessToken, baseUrl, patternClient);
 
-        webDriver.findElement(By.name("password")).sendKeys("new_password");
-        webDriver.findElement(By.name("password_confirmation")).sendKeys("new_password");
-        webDriver.clickAndWait(By.xpath("//input[@value='Create new password']"));
+        String finalUrl = resetPasswordWithClientRedirect(patternClientId, redirectUri);
 
-        assertThat(webDriver.getCurrentUrl()).isEqualTo(baseUrl + "/login?success=password_reset&form_redirect_uri=http://testzonedoesnotexist.localhost");
+        assertRedirectsToLoginWithSingleFormRedirectUri(finalUrl, redirectUri);
     }
 
     @Test
@@ -207,6 +202,12 @@ void codesCanOnlyBeUsedOnce() {
         beginPasswordReset(username);
         String link = getPasswordResetLink(email);
         webDriver.get(link);
+
+        webDriver.findElement(By.name("password")).sendKeys("new_password");
+        webDriver.findElement(By.name("password_confirmation")).sendKeys("new_password");
+        webDriver.clickAndWait(By.xpath("//input[@value='Create new password']"));
+        assertThat(webDriver.findElement(By.cssSelector(".alert-success")).getText()).contains("Password reset successful");
+
         webDriver.get(link);
         assertThat(webDriver.findElement(By.cssSelector(".error-message")).getText()).contains("Sorry, your reset password link is no longer valid. You can request another one below.");
     }
@@ -237,6 +238,45 @@ void resetPassword_displaysErrorMessage_NewPasswordSameAsOld() {
         assertThat(webDriver.findElement(By.cssSelector(".error-message")).getText()).contains("Your new password cannot be the same as the old password.");
     }
 
+    private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) {
+        UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build();
+        assertThat(redirect.getPath()).endsWith("/login");
+        assertThat(redirect.getFragment()).isNull();
+        assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri");
+        assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("password_reset");
+        assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri);
+    }
+
+    private String resetPasswordWithClientRedirect(String clientId, String redirectUri) throws Exception {
+        webDriver.get(baseUrl + "/forgot_password?client_id=" + clientId + "&redirect_uri=" + URLEncoder.encode(redirectUri, StandardCharsets.UTF_8));
+        assertThat(webDriver.findElement(By.tagName("h1")).getText()).isEqualTo("Reset Password");
+
+        int receivedEmailSize = greenMail.getReceivedMessages().length;
+
+        webDriver.findElement(By.name("username")).sendKeys(username);
+        webDriver.clickAndWait(By.xpath("//input[@value='Send reset password link']"));
+        assertThat(webDriver.findElement(By.tagName("h1")).getText()).isEqualTo("Instructions Sent");
+
+        greenMail.waitForIncomingEmail(5000, receivedEmailSize + 1);
+        assertThat(greenMail.getReceivedMessages()).hasSize(receivedEmailSize + 1);
+        MimeMessage message = greenMail.getReceivedMessages()[receivedEmailSize];
+        assertThat(message.getHeader("To")[0]).isEqualTo(email);
+        assertThat(GreenMailUtil.getBody(message)).contains("Reset your password");
+
+        assertThat(webDriver.findElement(By.cssSelector(".instructions-sent")).getText()).isEqualTo("Please check your email for a reset password link.");
+
+        String link = testClient.extractLink(GreenMailUtil.getBody(message));
+        assertThat(contains(link, "@")).isFalse();
+        assertThat(contains(link, "%40")).isFalse();
+        webDriver.get(link);
+
+        webDriver.findElement(By.name("password")).sendKeys("new_password");
+        webDriver.findElement(By.name("password_confirmation")).sendKeys("new_password");
+        webDriver.clickAndWait(By.xpath("//input[@value='Create new password']"));
+
+        return webDriver.getCurrentUrl();
+    }
+
     private void beginPasswordReset(String username) {
         webDriver.get(baseUrl + "/login");
         assertThat(webDriver.getTitle()).isEqualTo("Cloud Foundry");
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/util/IntegrationTestUtils.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/util/IntegrationTestUtils.java
index 922c8083d56..96b8d340409 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/util/IntegrationTestUtils.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/integration/util/IntegrationTestUtils.java
@@ -1618,6 +1618,12 @@ public static String createAnotherUser(UaaWebDriver webDriver, String password,
             throw new RuntimeException(e);
         }
 
+        // Confirming the account now lands on a forced password-set page; the owner must establish
+        // their password through the link before the account can be used to log in.
+        webDriver.findElement(By.name("password")).sendKeys(password);
+        webDriver.findElement(By.name("password_confirmation")).sendKeys(password);
+        webDriver.clickAndWait(By.xpath("//input[@value='Create new password']"));
+
         return userEmail;
     }
 
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcTests.java
index edcd6e45fad..a0381e1d0ee 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcTests.java
@@ -432,6 +432,135 @@ void inviteExistingUnverifiedUaaUser_codeContainsCreatedNewUserFalse(@Autowired
         jdbcTemplate.update("DELETE FROM users WHERE username = ?", email);
     }
 
+    @Test
+    void inviteVerifiedUserWithScimInviteOnly_returnsUserIdAndLinkByDefault() throws Exception {
+        String inviteOnlyToken = createScimInviteOnlyClient(mockMvc);
+        ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain);
+
+        InvitationsResponse response = sendRequestWithTokenAndReturnResponse(
+                webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail());
+
+        assertInvitedWithUserIdAndLink(response, verifiedUser);
+    }
+
+    @Nested
+    @DefaultTestContext
+    @TestPropertySource(properties = "scim.invite.allow_reinvite=true")
+    class WhenReinviteIsAllowed {
+
+        @Autowired // New mockMvc tied to the new web app context created by @TestPropertySource
+        protected MockMvc mockMvc;
+
+        @Test
+        void inviteVerifiedUserWithScimInviteOnly_returnsUserIdAndLink() throws Exception {
+            String inviteOnlyToken = createScimInviteOnlyClient(mockMvc);
+            ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain);
+
+            InvitationsResponse response = sendRequestWithTokenAndReturnResponse(
+                    webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail());
+
+            assertInvitedWithUserIdAndLink(response, verifiedUser);
+        }
+    }
+
+    @Nested
+    @DefaultTestContext
+    @TestPropertySource(properties = "scim.invite.allow_reinvite=false")
+    class WhenReinviteIsNotAllowed {
+
+        @Autowired // New mockMvc tied to the new web app context created by @TestPropertySource
+        protected MockMvc mockMvc;
+
+        @Test
+        void inviteVerifiedUserWithScimInviteOnlyClient_isReportedAsAlreadyVerified(@Autowired JdbcTemplate jdbcTemplate) throws Exception {
+            String inviteOnlyToken = createScimInviteOnlyClient(mockMvc);
+            ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain);
+            int codesBefore = jdbcTemplate.queryForObject("SELECT count(*) FROM expiring_code_store", Integer.class);
+
+            InvitationsResponse response = sendRequestWithTokenAndReturnResponse(
+                    webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail());
+
+            assertReportedAsAlreadyVerified(response, verifiedUser.getPrimaryEmail());
+            assertThat(jdbcTemplate.queryForObject("SELECT count(*) FROM expiring_code_store", Integer.class)).isEqualTo(codesBefore);
+        }
+
+        @Test
+        void inviteVerifiedUserWithScimInviteOnlyUserToken_isReportedAsAlreadyVerified() throws Exception {
+            String userToken = MockMvcUtils.getScimInviteUserToken(mockMvc, clientId, clientSecret, null, "admin", "adminsecret");
+            ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain);
+
+            InvitationsResponse response = sendRequestWithTokenAndReturnResponse(
+                    webApplicationContext, mockMvc, userToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail());
+
+            assertReportedAsAlreadyVerified(response, verifiedUser.getPrimaryEmail());
+        }
+
+        @Test
+        void inviteBatchWithScimInviteOnly_onlyTheVerifiedUserIsReported() throws Exception {
+            String inviteOnlyToken = createScimInviteOnlyClient(mockMvc);
+            ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain);
+            String unverifiedEmail = "unverified-" + generator.generate().toLowerCase() + "@" + emailDomain;
+            String newEmail = "new-" + generator.generate().toLowerCase() + "@" + emailDomain;
+            sendRequestWithTokenAndReturnResponse(webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", unverifiedEmail);
+
+            InvitationsResponse response = sendRequestWithTokenAndReturnResponse(
+                    webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail(), unverifiedEmail, newEmail);
+
+            assertThat(response.getNewInvites())
+                    .extracting(InvitationsResponse.Invitee::getEmail)
+                    .containsExactlyInAnyOrder(unverifiedEmail, newEmail);
+            assertThat(response.getNewInvites()).allSatisfy(invitee -> {
+                assertThat(invitee.getUserId()).isNotNull();
+                assertThat(invitee.getInviteLink()).isNotNull();
+            });
+            assertThat(response.getFailedInvites())
+                    .singleElement()
+                    .satisfies(invitee -> assertThat(invitee.getErrorCode()).isEqualTo("user.already-verified"))
+                    .extracting(InvitationsResponse.Invitee::getEmail)
+                    .isEqualTo(verifiedUser.getPrimaryEmail());
+        }
+
+        @Test
+        void inviteUnverifiedUserWithScimInviteOnly_returnsUserIdAndLink() throws Exception {
+            String inviteOnlyToken = createScimInviteOnlyClient(mockMvc);
+            String unverifiedEmail = "unverified-" + generator.generate().toLowerCase() + "@" + emailDomain;
+            String firstUserId = sendRequestWithTokenAndReturnResponse(
+                    webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", unverifiedEmail)
+                    .getNewInvites().getFirst().getUserId();
+
+            InvitationsResponse response = sendRequestWithTokenAndReturnResponse(
+                    webApplicationContext, mockMvc, inviteOnlyToken, null, clientId, "example.com", unverifiedEmail);
+
+            assertThat(response.getFailedInvites()).isEmpty();
+            assertThat(response.getNewInvites()).singleElement().satisfies(invitee -> {
+                assertThat(invitee.getUserId()).isEqualTo(firstUserId);
+                assertThat(invitee.getInviteLink()).isNotNull();
+            });
+        }
+
+        @Test
+        void inviteVerifiedUserWithScimRead_returnsUserIdAndLink() throws Exception {
+            String scimReadAndInviteToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, clientId, clientSecret, "scim.read scim.invite", null);
+            ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain);
+
+            InvitationsResponse response = sendRequestWithTokenAndReturnResponse(
+                    webApplicationContext, mockMvc, scimReadAndInviteToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail());
+
+            assertInvitedWithUserIdAndLink(response, verifiedUser);
+        }
+
+        @Test
+        void inviteVerifiedUserAsUaaAdmin_returnsUserIdAndLink() throws Exception {
+            String uaaAdminToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, "admin", "adminsecret", "uaa.admin", null);
+            ScimUser verifiedUser = createVerifiedUser(mockMvc, "verified-" + generator.generate().toLowerCase() + "@" + emailDomain);
+
+            InvitationsResponse response = sendRequestWithTokenAndReturnResponse(
+                    webApplicationContext, mockMvc, uaaAdminToken, null, clientId, "example.com", verifiedUser.getPrimaryEmail());
+
+            assertInvitedWithUserIdAndLink(response, verifiedUser);
+        }
+    }
+
     @Test
     void acceptInvitationEmailWithDefaultCompanyName() throws Exception {
         MvcResult mvcResult = mockMvc.perform(get(getAcceptInvitationLink(webApplicationContext, mockMvc, clientId, clientSecret, generator, emailDomain, null, "admin", "adminsecret")))
@@ -486,6 +615,47 @@ void invitationsAcceptGetSecurity(@Autowired JdbcTemplate jdbcTemplate) throws E
                 .contains("<form action=\"/invitations/accept.do\" method=\"post\" novalidate=\"novalidate\">");
     }
 
+    private String createScimInviteOnlyClient(MockMvc mockMvc) throws Exception {
+        String inviteOnlyClientId = generator.generate().toLowerCase();
+        String inviteOnlyClientSecret = generator.generate().toLowerCase();
+        String clientAdminToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, "admin", "adminsecret", "clients.write", null);
+        MockMvcUtils.createClient(mockMvc, clientAdminToken, inviteOnlyClientId, inviteOnlyClientSecret, Collections.singleton("oauth"),
+                Collections.singletonList("scim.invite"), Collections.singletonList("client_credentials"), "scim.invite");
+        return MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, inviteOnlyClientId, inviteOnlyClientSecret, "scim.invite", null);
+    }
+
+    private static ScimUser createVerifiedUser(MockMvc mockMvc, String email) throws Exception {
+        String scimWriteToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, "admin", "adminsecret", "scim.write", null);
+        ScimUser user = new ScimUser(null, email, "givenName", "familyName");
+        user.setPrimaryEmail(email);
+        user.setPassword("password");
+        ScimUser created = MockMvcUtils.createUser(mockMvc, scimWriteToken, user);
+        assertThat(created.isVerified()).isTrue();
+        return created;
+    }
+
+    private static void assertInvitedWithUserIdAndLink(InvitationsResponse response, ScimUser user) {
+        assertThat(response.getFailedInvites()).isEmpty();
+        assertThat(response.getNewInvites()).singleElement().satisfies(invitee -> {
+            assertThat(invitee.getEmail()).isEqualTo(user.getPrimaryEmail());
+            assertThat(invitee.getUserId()).isEqualTo(user.getId());
+            assertThat(invitee.isSuccess()).isTrue();
+            assertThat(invitee.getInviteLink()).isNotNull();
+        });
+    }
+
+    private static void assertReportedAsAlreadyVerified(InvitationsResponse response, String email) {
+        assertThat(response.getNewInvites()).isEmpty();
+        assertThat(response.getFailedInvites()).singleElement().satisfies(invitee -> {
+            assertThat(invitee.getEmail()).isEqualTo(email);
+            assertThat(invitee.isSuccess()).isFalse();
+            assertThat(invitee.getErrorCode()).isEqualTo("user.already-verified");
+            assertThat(invitee.getErrorMessage()).isEqualTo("The user is already verified.");
+            assertThat(invitee.getUserId()).isNull();
+            assertThat(invitee.getInviteLink()).isNull();
+        });
+    }
+
     private static InvitationsResponse sendRequestWithTokenAndReturnResponse(WebApplicationContext webApplicationContext,
                                                                              MockMvc mockMvc,
                                                                              String token,
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcZonePathTests.java
index 9cbcc0a8da2..f2e827ea9a5 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcZonePathTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/invitations/InvitationsEndpointMockMvcZonePathTests.java
@@ -249,6 +249,52 @@ void inviteUserWithUserCredentialsWithinZone(ZoneResolutionMode mode) throws Exc
         assertResponseAndCodeCorrect(expiringCodeStore, new String[]{email}, redirectUrl, mode, zoneResult.getIdentityZone(), response, zonedClientDetails);
     }
 
+    @ParameterizedTest
+    @EnumSource(ZoneResolutionMode.class)
+    void inviteVerifiedUserWithinZoneWithScimInviteOnly_returnsUserIdAndLinkByDefault(ZoneResolutionMode mode) throws Exception {
+        InviteZone zone = createInviteZone(mockMvc, webApplicationContext);
+        ScimUser verifiedUser = createVerifiedUserInZone(mockMvc, zone, "verified-" + generator.generate().toLowerCase() + "@example.com");
+
+        InvitationsResponse response = inviteWithinZone(mockMvc, mode, zone, zone.scimInviteUserToken(), verifiedUser.getPrimaryEmail());
+
+        assertInvitedWithUserIdAndLink(response, verifiedUser);
+    }
+
+    @Nested
+    @DefaultTestContext
+    @TestPropertySource(properties = "scim.invite.allow_reinvite=false")
+    class WhenReinviteIsNotAllowed {
+
+        @Autowired // New mockMvc tied to the new web app context created by @TestPropertySource
+        protected MockMvc mockMvc;
+
+        @Autowired
+        protected WebApplicationContext webApplicationContext;
+
+        @ParameterizedTest
+        @EnumSource(ZoneResolutionMode.class)
+        void inviteVerifiedUserWithinZoneWithScimInviteOnly_isReportedAsAlreadyVerified(ZoneResolutionMode mode) throws Exception {
+            InviteZone zone = createInviteZone(mockMvc, webApplicationContext);
+            ScimUser verifiedUser = createVerifiedUserInZone(mockMvc, zone, "verified-" + generator.generate().toLowerCase() + "@example.com");
+
+            InvitationsResponse response = inviteWithinZone(mockMvc, mode, zone, zone.scimInviteUserToken(), verifiedUser.getPrimaryEmail());
+
+            assertReportedAsAlreadyVerified(response, verifiedUser.getPrimaryEmail());
+        }
+
+        @ParameterizedTest
+        @EnumSource(ZoneResolutionMode.class)
+        void inviteVerifiedUserWithinZoneWithScimRead_returnsUserIdAndLink(ZoneResolutionMode mode) throws Exception {
+            InviteZone zone = createInviteZone(mockMvc, webApplicationContext);
+            ScimUser verifiedUser = createVerifiedUserInZone(mockMvc, zone, "verified-" + generator.generate().toLowerCase() + "@example.com");
+            String scimReadAndInviteToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, zone.clientId(), zone.clientSecret(), "scim.read scim.invite", zone.subdomain());
+
+            InvitationsResponse response = inviteWithinZone(mockMvc, mode, zone, scimReadAndInviteToken, verifiedUser.getPrimaryEmail());
+
+            assertInvitedWithUserIdAndLink(response, verifiedUser);
+        }
+    }
+
     @Nested
     @DefaultTestContext
     @TestPropertySource(
@@ -770,6 +816,70 @@ private static InvitationsResponse sendRequestWithTokenAndReturnResponse(WebAppl
                 mockMvc, token, subdomain, clientId, redirectUri, emails);
     }
 
+    private record InviteZone(String subdomain, IdentityZone identityZone, String clientId, String clientSecret, String scimInviteUserToken) {
+    }
+
+    private InviteZone createInviteZone(MockMvc mockMvc, WebApplicationContext webApplicationContext) throws Exception {
+        String subdomain = generator.generate().toLowerCase();
+        UaaClientDetails adminClient = new UaaClientDetails("admin", null, null, "client_credentials",
+                "clients.admin,scim.read,scim.write,idps.write,uaa.admin", "http://redirect.url");
+        adminClient.setClientSecret("admin-secret");
+        IdentityZoneCreationResult zoneResult = MockMvcUtils.createOtherIdentityZoneAndReturnResult(subdomain, mockMvc, webApplicationContext, adminClient, IdentityZoneHolder.getCurrentZoneId());
+
+        String zonedClientId = generator.generate().toLowerCase();
+        String zonedClientSecret = generator.generate().toLowerCase();
+        MockMvcUtils.createClient(mockMvc, zoneResult.getZoneAdminToken(), zonedClientId, zonedClientSecret,
+                Collections.singleton("oauth"), Arrays.asList("scim.read", "scim.invite"), Arrays.asList("client_credentials", "password"),
+                "scim.read,scim.invite", Collections.singleton("http://redirect.url"), zoneResult.getIdentityZone());
+        String userToken = MockMvcUtils.getScimInviteUserToken(mockMvc, zonedClientId, zonedClientSecret, zoneResult.getIdentityZone(), "admin", "admin-secret");
+        return new InviteZone(subdomain, zoneResult.getIdentityZone(), zonedClientId, zonedClientSecret, userToken);
+    }
+
+    private static ScimUser createVerifiedUserInZone(MockMvc mockMvc, InviteZone zone, String email) throws Exception {
+        String zoneAdminToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, "admin", "admin-secret", "", zone.subdomain());
+        ScimUser user = new ScimUser(null, email, "givenName", "familyName");
+        user.setPrimaryEmail(email);
+        user.setPassword("password");
+        ScimUser created = MockMvcUtils.createUserInZone(mockMvc, zoneAdminToken, user, zone.subdomain());
+        assertThat(created.isVerified()).isTrue();
+        return created;
+    }
+
+    private static InvitationsResponse inviteWithinZone(MockMvc mockMvc, ZoneResolutionMode mode, InviteZone zone, String token, String... emails) throws Exception {
+        MockHttpServletRequestBuilder post = mode.createRequestBuilder(zone.subdomain(), HttpMethod.POST, "/invite_users")
+                .param(OAuth2Utils.CLIENT_ID, zone.clientId())
+                .param(OAuth2Utils.REDIRECT_URI, "example.com")
+                .header("Authorization", "Bearer " + token)
+                .contentType(APPLICATION_JSON)
+                .content(writeValueAsString(new InvitationsRequest(emails)));
+        MvcResult mvcResult = mockMvc.perform(post)
+                .andExpect(status().isOk())
+                .andReturn();
+        return readValue(mvcResult.getResponse().getContentAsString(), InvitationsResponse.class);
+    }
+
+    private static void assertInvitedWithUserIdAndLink(InvitationsResponse response, ScimUser user) {
+        assertThat(response.getFailedInvites()).isEmpty();
+        assertThat(response.getNewInvites()).singleElement().satisfies(invitee -> {
+            assertThat(invitee.getEmail()).isEqualTo(user.getPrimaryEmail());
+            assertThat(invitee.getUserId()).isEqualTo(user.getId());
+            assertThat(invitee.isSuccess()).isTrue();
+            assertThat(invitee.getInviteLink()).isNotNull();
+        });
+    }
+
+    private static void assertReportedAsAlreadyVerified(InvitationsResponse response, String email) {
+        assertThat(response.getNewInvites()).isEmpty();
+        assertThat(response.getFailedInvites()).singleElement().satisfies(invitee -> {
+            assertThat(invitee.getEmail()).isEqualTo(email);
+            assertThat(invitee.isSuccess()).isFalse();
+            assertThat(invitee.getErrorCode()).isEqualTo("user.already-verified");
+            assertThat(invitee.getErrorMessage()).isEqualTo("The user is already verified.");
+            assertThat(invitee.getUserId()).isNull();
+            assertThat(invitee.getInviteLink()).isNull();
+        });
+    }
+
     private static void assertResponseAndCodeCorrect(ExpiringCodeStore expiringCodeStore, String[] emails, String redirectUrl, IdentityZone zone, InvitationsResponse response, ClientDetails clientDetails) {
         String expectedLinkPrefix = (zone != null && StringUtils.hasText(zone.getSubdomain()))
                 ? "http://" + zone.getSubdomain() + ".localhost/invitations/accept"
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java
index 288012441b1..8b9ce345a10 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcTests.java
@@ -1,10 +1,13 @@
 package org.cloudfoundry.identity.uaa.login;
 
+import jakarta.mail.Message;
+import java.nio.charset.StandardCharsets;
 import org.apache.commons.lang3.RandomStringUtils;
 import org.cloudfoundry.identity.uaa.DefaultTestContext;
 import org.cloudfoundry.identity.uaa.account.EmailAccountCreationService;
 import org.cloudfoundry.identity.uaa.authentication.UaaPrincipal;
 import org.cloudfoundry.identity.uaa.client.UaaClientDetails;
+import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeType;
 import org.cloudfoundry.identity.uaa.codestore.JdbcExpiringCodeStore;
 import org.cloudfoundry.identity.uaa.constants.OriginKeys;
 import org.cloudfoundry.identity.uaa.login.test.MockMvcTestClient;
@@ -42,13 +45,19 @@
 import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
 import org.springframework.web.context.WebApplicationContext;
 import org.springframework.web.context.support.StandardServletEnvironment;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
 
+import java.sql.Timestamp;
 import java.util.Collections;
+import java.util.Map;
+import org.springframework.web.util.UriUtils;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils.CookieCsrfPostProcessor.cookieCsrf;
 import static org.springframework.http.MediaType.APPLICATION_JSON;
 import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
+import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.unauthenticated;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.model;
@@ -62,7 +71,6 @@
 @DefaultTestContext
 class AccountsControllerMockMvcTests {
 
-    private static final String LOGIN_REDIRECT = "/login?success=verify_success";
     private static final String USER_PASSWORD = "secr3T";
     private final AlphanumericRandomValueStringGenerator generator = new AlphanumericRandomValueStringGenerator();
     private String userEmail;
@@ -135,6 +143,78 @@ void activationEmailSentPage() throws Exception {
         assertThat(result.getResponse().getContentAsString()).contains("Create your account");
     }
 
+    @Test
+    void activationEmailSentPageWithoutAnAddressStillRenders() throws Exception {
+        mockMvc.perform(get("/accounts/email_sent"))
+                .andExpect(status().isOk())
+                .andExpect(xpath("//input[@disabled='disabled']/@value").string("Email successfully sent"));
+    }
+
+    @Test
+    void creatingAnAccountShowsTheEmailOnTheConfirmationPage() throws Exception {
+        useRandomActivationCodes();
+        MockHttpSession session = new MockHttpSession();
+        mockMvc.perform(post("/create_account.do")
+                        .with(cookieCsrf())
+                        .session(session)
+                        .param("email", userEmail)
+                        .param("password", "secr3T")
+                        .param("password_confirmation", "secr3T"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+
+        MvcResult page = mockMvc.perform(get("/accounts/email_sent").session(session))
+                .andExpect(status().isOk())
+                .andReturn();
+
+        assertThat(page.getResponse().getContentAsString()).contains(userEmail);
+    }
+
+    @Test
+    void creatingAnAccountForAnExistingVerifiedUserRedirectsLikeANewAddress() throws Exception {
+        useRandomActivationCodes();
+        createVerifiedUaaUser(userEmail);
+
+        mockMvc.perform(post("/create_account.do")
+                        .with(cookieCsrf())
+                        .param("email", userEmail)
+                        .param("password", "secr3T")
+                        .param("password_confirmation", "secr3T"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+    }
+
+    @Test
+    void creatingAnAccountForAnExistingVerifiedUserMailsTheOwnerWithoutAnActivationLink() throws Exception {
+        useRandomActivationCodes();
+        createVerifiedUaaUser(userEmail);
+
+        mockMvc.perform(post("/create_account.do")
+                .with(cookieCsrf())
+                .param("email", userEmail)
+                .param("password", "secr3T")
+                .param("password_confirmation", "secr3T"));
+
+        assertThat(fakeJavaMailSender.getSentMessages()).hasSize(1);
+        FakeJavaMailSender.MimeMessageWrapper message = fakeJavaMailSender.getSentMessages().getFirst();
+        assertThat(message.getRecipients(Message.RecipientType.TO)).hasSize(1);
+        assertThat(message.getRecipients(Message.RecipientType.TO).getFirst()).hasToString(userEmail);
+        assertThat(message.getContentString()).doesNotContain("verify_user");
+    }
+
+    private void useRandomActivationCodes() {
+        webApplicationContext.getBean(JdbcExpiringCodeStore.class).setGenerator(new AlphanumericRandomValueStringGenerator(24));
+    }
+
+    private void createVerifiedUaaUser(String email) {
+        ScimUser existing = new ScimUser(null, email, "Given", "Family");
+        existing.setPrimaryEmail(email);
+        existing.setOrigin(OriginKeys.UAA);
+        existing.setVerified(true);
+        webApplicationContext.getBean(JdbcScimUserProvisioning.class)
+                .createUser(existing, USER_PASSWORD, IdentityZoneHolder.get().getId());
+    }
+
     @Test
     void activationEmailSentPageWithinZone() throws Exception {
         String subdomain = generator.generate();
@@ -241,11 +321,7 @@ void creatingAnAccount() throws Exception {
         ScimUser scimUser = scimUserProvisioning.query("userName eq '" + userEmail + "' and origin eq '" + OriginKeys.UAA + "'", IdentityZoneHolder.get().getId()).getFirst();
         assertThat(scimUser.isVerified()).isFalse();
 
-        mockMvc.perform(get("/verify_user")
-                        .param("code", "test" + generator.counter.get()))
-                .andExpect(status().isFound())
-                .andExpect(redirectedUrl(LOGIN_REDIRECT))
-                .andReturn();
+        confirmAccountAndSetPassword("test" + generator.counter.get(), "", userEmail);
 
         MvcResult mvcResult = loginWithAccount("")
                 .andExpect(authenticated())
@@ -260,26 +336,210 @@ void creatingAnAccount() throws Exception {
     }
 
     @Test
-    void creatingAnAccountWithAnEmptyClientId() throws Exception {
+    void confirmingAccountDoesNotAuthorizeThePreRegisteredPassword() throws Exception {
         PredictableGenerator generator = new PredictableGenerator();
         JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class);
         store.setGenerator(generator);
 
+        String registrationPassword = "firstPass1";
+
         mockMvc.perform(post("/create_account.do")
                         .with(cookieCsrf())
                         .param("email", userEmail)
-                        .param("password", "secr3T")
-                        .param("password_confirmation", "secr3T")
-                        .param("client_id", ""))
+                        .param("password", registrationPassword)
+                        .param("password_confirmation", registrationPassword))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+
+        mockMvc.perform(get("/verify_user")
+                        .param("code", "test" + generator.counter.get()))
+                .andExpect(status().isFound())
+                .andReturn();
+
+        // Clicking the confirmation link only proves ownership of the email address. The
+        // password supplied on the registration form must not become a usable credential once
+        // the account is confirmed; the owner must establish the password through the link.
+        mockMvc.perform(post("/login.do")
+                        .with(cookieCsrf())
+                        .param("username", userEmail)
+                        .param("password", registrationPassword))
+                .andExpect(unauthenticated());
+    }
+
+    @Test
+    void confirmingAccountDoesNotAuthorizePasswordFromEarlierRegistration() throws Exception {
+        PredictableGenerator generator = new PredictableGenerator();
+        JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class);
+        store.setGenerator(generator);
+
+        String firstRegistrationPassword = "firstPass1";
+        String laterRegistrationPassword = "laterPass2";
+
+        // First registration for the address.
+        mockMvc.perform(post("/create_account.do")
+                        .with(cookieCsrf())
+                        .param("email", userEmail)
+                        .param("password", firstRegistrationPassword)
+                        .param("password_confirmation", firstRegistrationPassword))
                 .andExpect(status().isFound())
                 .andExpect(redirectedUrl("accounts/email_sent"));
 
+        // A later registration for the same still-unconfirmed address.
+        mockMvc.perform(post("/create_account.do")
+                        .with(cookieCsrf())
+                        .param("email", userEmail)
+                        .param("password", laterRegistrationPassword)
+                        .param("password_confirmation", laterRegistrationPassword))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+
+        // The owner confirms the account using the most recent link.
         mockMvc.perform(get("/verify_user")
                         .param("code", "test" + generator.counter.get()))
                 .andExpect(status().isFound())
-                .andExpect(redirectedUrl(LOGIN_REDIRECT))
                 .andReturn();
 
+        // Confirmation must not authorize the password chosen by the earlier registration.
+        mockMvc.perform(post("/login.do")
+                        .with(cookieCsrf())
+                        .param("username", userEmail)
+                        .param("password", firstRegistrationPassword))
+                .andExpect(unauthenticated());
+    }
+
+    @Test
+    void confirmingAccountSendsOwnerToForcedPasswordSetup() throws Exception {
+        PredictableGenerator generator = new PredictableGenerator();
+        JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class);
+        store.setGenerator(generator);
+
+        mockMvc.perform(post("/create_account.do")
+                        .with(cookieCsrf())
+                        .param("email", userEmail)
+                        .param("password", "secr3T")
+                        .param("password_confirmation", "secr3T"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+
+        // Confirming the account sends the owner to the reset-password page to establish a password.
+        MvcResult verifyResult = mockMvc.perform(get("/verify_user")
+                        .param("code", "test" + generator.counter.get()))
+                .andExpect(status().isFound())
+                .andReturn();
+
+        String location = verifyResult.getResponse().getRedirectedUrl();
+        assertThat(location)
+                .startsWith("/reset_password?code=")
+                .contains("force_change=true");
+        String resetCode = UriComponentsBuilder.fromUriString(location).build().getQueryParams().getFirst("code");
+
+        // The page explains that a password change is required due to changes in the system.
+        MvcResult pageResult = mockMvc.perform(get("/reset_password")
+                        .param("code", resetCode)
+                        .param("force_change", "true"))
+                .andExpect(status().isOk())
+                .andExpect(view().name("reset_password"))
+                .andExpect(model().attribute("message_code", "force_change"))
+                .andReturn();
+        String formCode = (String) pageResult.getModelAndView().getModel().get("code");
+
+        mockMvc.perform(post("/reset_password.do")
+                        .with(cookieCsrf())
+                        .param("code", formCode)
+                        .param("email", userEmail)
+                        .param("password", USER_PASSWORD)
+                        .param("password_confirmation", USER_PASSWORD))
+                .andExpect(status().isFound());
+
+        // Once the owner has set their own password, the account can be used to log in.
+        mockMvc.perform(post("/login.do")
+                        .with(cookieCsrf())
+                        .param("username", userEmail)
+                        .param("password", USER_PASSWORD))
+                .andExpect(authenticated());
+    }
+
+    @Test
+    void openingAnotherActivationLinkAfterPasswordSetupKeepsThePassword() throws Exception {
+        PredictableGenerator generator = new PredictableGenerator();
+        JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class);
+        store.setGenerator(generator);
+
+        // Two registrations for the same unconfirmed address send two activation links.
+        mockMvc.perform(post("/create_account.do")
+                        .with(cookieCsrf())
+                        .param("email", userEmail)
+                        .param("password", "firstPass1")
+                        .param("password_confirmation", "firstPass1"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+        String firstActivationCode = "test" + generator.counter.get();
+
+        mockMvc.perform(post("/create_account.do")
+                        .with(cookieCsrf())
+                        .param("email", userEmail)
+                        .param("password", "laterPass2")
+                        .param("password_confirmation", "laterPass2"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+        String secondActivationCode = "test" + generator.counter.get();
+
+        // The owner confirms with the second link and sets a password.
+        confirmAccountAndSetPassword(secondActivationCode, "", userEmail);
+
+        // Opening the first link afterwards must not replace that password.
+        mockMvc.perform(get("/verify_user")
+                        .param("code", firstActivationCode))
+                .andExpect(status().isFound());
+
+        loginWithAccount("")
+                .andExpect(authenticated());
+    }
+
+    @Test
+    void openingAnOldActivationCodeOfAnExternalUserLeavesTheAccountWithTheSameUsernameAlone() throws Exception {
+        String zoneId = IdentityZoneHolder.get().getId();
+        JdbcScimUserProvisioning provisioning = webApplicationContext.getBean(JdbcScimUserProvisioning.class);
+        createVerifiedUaaUser(userEmail);
+
+        ScimUser external = new ScimUser(null, userEmail, "Given", "Family");
+        external.setPrimaryEmail(userEmail);
+        external.setOrigin("some-external-origin");
+        external.setVerified(false);
+        external = provisioning.createUser(external, "", zoneId);
+
+        // a code from the user API issued before codes carried a marker
+        String code = webApplicationContext.getBean(JdbcExpiringCodeStore.class).generateCode(
+                JsonUtils.writeValueAsString(Map.of("user_id", external.getId(), "email", userEmail)),
+                new Timestamp(System.currentTimeMillis() + 60_000), ExpiringCodeType.REGISTRATION.name(), zoneId).getCode();
+
+        // the external user is verified; no reset code is issued for the uaa account with the same username
+        mockMvc.perform(get("/verify_user").param("code", code))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("/login?success=verify_success"));
+        assertThat(provisioning.retrieve(external.getId(), zoneId).isVerified()).isTrue();
+
+        loginWithAccount("")
+                .andExpect(authenticated());
+    }
+
+    @Test
+    void creatingAnAccountWithAnEmptyClientId() throws Exception {
+        PredictableGenerator generator = new PredictableGenerator();
+        JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class);
+        store.setGenerator(generator);
+
+        mockMvc.perform(post("/create_account.do")
+                        .with(cookieCsrf())
+                        .param("email", userEmail)
+                        .param("password", "secr3T")
+                        .param("password_confirmation", "secr3T")
+                        .param("client_id", ""))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+
+        confirmAccountAndSetPassword("test" + generator.counter.get(), "", userEmail);
+
         MvcResult mvcResult = loginWithAccount("")
                 .andExpect(authenticated())
                 .andReturn();
@@ -297,11 +557,40 @@ void creatingAnAccountWithClientRedirect() throws Exception {
         createAccount("http://redirect.uri/client", "http://redirect.uri/client");
     }
 
+    @Test
+    void creatingAnAccountKeepsClientRedirectWithQueryAsOneFormRedirectParameter() throws Exception {
+        createAccount("http://redirect.uri/page?first=1&second=2#fragment", "http://redirect.uri/page?first=1&second=2#fragment");
+    }
+
     @Test
     void creatingAnAccountWithFallbackClientRedirect() throws Exception {
         createAccount("http://redirect.uri/fallback", null);
     }
 
+    @Test
+    void creatingAnAccountWithFallbackClientRedirectThatIsNotARegisteredRedirectUri() throws Exception {
+        PredictableGenerator generator = new PredictableGenerator();
+        JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class);
+        store.setGenerator(generator);
+        // the client's redirect URIs are http://redirect.uri/*, so this fallback matches none of them
+        UaaClientDetails clientDetails = createTestClient("http://other.uri/after-signup");
+
+        mockMvc.perform(post("/create_account.do")
+                        .with(cookieCsrf())
+                        .param("email", userEmail)
+                        .param("password", USER_PASSWORD)
+                        .param("password_confirmation", USER_PASSWORD)
+                        .param("client_id", clientDetails.getClientId()))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+
+        String afterReset = confirmAccountAndSetPassword("test" + generator.counter.get(), "", userEmail);
+
+        // signup_redirect_url is set on the client by an administrator, so it applies after the
+        // password is set even when it is not one of the client's registered redirect URIs.
+        assertRedirectsToLoginWithSingleFormRedirectUri(afterReset, "http://other.uri/after-signup");
+    }
+
     @Test
     void creatingAnAccountWithNoClientRedirect() throws Exception {
         PredictableGenerator generator = new PredictableGenerator();
@@ -320,11 +609,7 @@ void creatingAnAccountWithNoClientRedirect() throws Exception {
         assertThat(message.getContentString()).contains("Cloud Foundry");
         assertThat(message.getMessage().getHeader("From")).contains("Cloud Foundry <admin@localhost>");
 
-        mockMvc.perform(get("/verify_user")
-                        .param("code", "test" + generator.counter.get()))
-                .andExpect(status().isFound())
-                .andExpect(redirectedUrl(LOGIN_REDIRECT))
-                .andReturn();
+        confirmAccountAndSetPassword("test" + generator.counter.get(), "", userEmail);
 
         MvcResult mvcResult = loginWithAccount("")
                 .andExpect(authenticated())
@@ -375,12 +660,7 @@ void creatingAnAccountInAnotherZoneWithNoClientRedirect() throws Exception {
         assertThat(hasLength(link)).isTrue();
         assertThat(link).contains(subdomain + ".localhost");
 
-        mockMvc.perform(get("/verify_user")
-                        .param("code", "test" + generator.counter.get())
-                        .with(new SetServerNameRequestPostProcessor(subdomain + ".localhost")))
-                .andExpect(status().isFound())
-                .andExpect(redirectedUrl(LOGIN_REDIRECT))
-                .andReturn();
+        confirmAccountAndSetPassword("test" + generator.counter.get(), subdomain, userEmail);
 
         MvcResult mvcResult = loginWithAccount(subdomain)
                 .andExpect(redirectedUrl("/"))
@@ -425,11 +705,8 @@ void creatingAnAccountInAnotherZoneWithClientRedirect() throws Exception {
         assertThat(hasLength(link)).isTrue();
         assertThat(link).contains(subdomain + ".localhost");
 
-        mockMvc.perform(get("/verify_user")
-                        .param("code", "test" + generator.counter.get())
-                        .with(new SetServerNameRequestPostProcessor(subdomain + ".localhost")))
-                .andExpect(redirectedUrl(LOGIN_REDIRECT + "&form_redirect_uri=http://myzoneclient.example.com"))
-                .andReturn();
+        String afterReset = confirmAccountAndSetPassword("test" + generator.counter.get(), subdomain, userEmail);
+        assertRedirectsToLoginWithSingleFormRedirectUri(afterReset, "http://myzoneclient.example.com");
 
         MvcResult mvcResult = loginWithAccount(subdomain)
                 .andExpect(authenticated())
@@ -468,14 +745,29 @@ void redirectToSavedRequest_ifPresent() throws Exception {
                         .param("password_confirmation", "test-password"))
                 .andExpect(redirectedUrl("accounts/email_sent"));
 
-        mockMvc.perform(get("/verify_user")
+        MvcResult verifyResult = mockMvc.perform(get("/verify_user")
                         .session(session)
                         .param("code", "test" + generator.counter.get()))
                 .andExpect(status().isFound())
-                .andExpect(redirectedUrl(LOGIN_REDIRECT))
                 .andReturn();
 
+        String location = verifyResult.getResponse().getRedirectedUrl();
+        assertThat(location)
+                .startsWith("/reset_password?code=")
+                .contains("force_change=true");
+
         assertThat(SessionUtils.getSavedRequestSession(MockMvcUtils.getZoneSession(session)).getRedirectUrl()).isNotNull();
+
+        // Consume the reset code so the predictable code sequence does not collide with later tests.
+        String resetCode = UriComponentsBuilder.fromUriString(location).build().getQueryParams().getFirst("code");
+        mockMvc.perform(post("/reset_password.do")
+                        .with(cookieCsrf())
+                        .session(session)
+                        .param("code", resetCode)
+                        .param("email", "testuser@test.org")
+                        .param("password", USER_PASSWORD)
+                        .param("password_confirmation", USER_PASSWORD))
+                .andExpect(status().isFound());
     }
 
     @Test
@@ -566,13 +858,26 @@ void consentIfConfiguredDisplaysMeaningfulErrorWhenConsentNotProvided() throws E
         assertThat(result.getResponse().getContentAsString()).contains("Please agree before continuing.");
     }
 
+    private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) {
+        UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build();
+        assertThat(redirect.getPath()).endsWith("/login");
+        assertThat(redirect.getFragment()).isNull();
+        assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri");
+        assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("password_reset");
+        assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri);
+    }
+
     private UaaClientDetails createTestClient() throws Exception {
+        return createTestClient("http://redirect.uri/fallback");
+    }
+
+    private UaaClientDetails createTestClient(String signupRedirectUrl) throws Exception {
         UaaClientDetails clientDetails = new UaaClientDetails();
         clientDetails.setClientId("test-client-" + RandomStringUtils.randomAlphanumeric(200));
         clientDetails.setClientSecret("test-client-secret");
         clientDetails.setAuthorizedGrantTypes(Collections.singletonList("client_credentials"));
         clientDetails.setRegisteredRedirectUri(Collections.singleton("http://redirect.uri/*"));
-        clientDetails.addAdditionalInformation(EmailAccountCreationService.SIGNUP_REDIRECT_URL, "http://redirect.uri/fallback");
+        clientDetails.addAdditionalInformation(EmailAccountCreationService.SIGNUP_REDIRECT_URL, signupRedirectUrl);
 
         UaaTestAccounts testAccounts = UaaTestAccounts.standard(null);
         String adminToken = testClient.getClientCredentialsOAuthAccessToken(testAccounts.getAdminClientId(),
@@ -600,11 +905,8 @@ private void createAccount(String expectedRedirectUri, String redirectUri) throw
         assertThat(message.getContentString()).contains("Cloud Foundry");
         assertThat(message.getMessage().getHeader("From")).contains("Cloud Foundry <admin@localhost>");
 
-        mockMvc.perform(get("/verify_user")
-                        .param("code", "test" + generator.counter.get()))
-                .andExpect(status().isFound())
-                .andExpect(redirectedUrl(LOGIN_REDIRECT + "&form_redirect_uri=" + expectedRedirectUri))
-                .andReturn();
+        String afterReset = confirmAccountAndSetPassword("test" + generator.counter.get(), "", userEmail);
+        assertRedirectsToLoginWithSingleFormRedirectUri(afterReset, expectedRedirectUri);
 
         MvcResult mvcResult = loginWithAccount("")
                 .andExpect(authenticated())
@@ -618,6 +920,44 @@ private void createAccount(String expectedRedirectUri, String redirectUri) throw
         assertThat(principal.getOrigin()).isEqualTo(OriginKeys.UAA);
     }
 
+    /**
+     * Account confirmation no longer leaves a usable password: clicking the activation link sends
+     * the owner to the reset-password page to establish their own password. This helper completes
+     * that flow, confirming the account via {@code /verify_user} and setting the password to
+     * {@link #USER_PASSWORD} so the account can then be used to log in.
+     */
+    private String confirmAccountAndSetPassword(String activationCode, String subdomain, String email) throws Exception {
+        MockHttpServletRequestBuilder verify = get("/verify_user").param("code", activationCode);
+        if (hasText(subdomain)) {
+            verify.with(new SetServerNameRequestPostProcessor(subdomain + ".localhost"));
+        }
+        MvcResult verifyResult = mockMvc.perform(verify)
+                .andExpect(status().isFound())
+                .andReturn();
+
+        String location = verifyResult.getResponse().getRedirectedUrl();
+        assertThat(location)
+                .startsWith("/reset_password?code=")
+                .contains("force_change=true");
+        String resetCode = UriComponentsBuilder.fromUriString(location).build().getQueryParams().getFirst("code");
+
+        MockHttpServletRequestBuilder reset = post("/reset_password.do")
+                .with(cookieCsrf())
+                .param("code", resetCode)
+                .param("email", email)
+                .param("password", USER_PASSWORD)
+                .param("password_confirmation", USER_PASSWORD);
+        if (hasText(subdomain)) {
+            reset.with(new SetServerNameRequestPostProcessor(subdomain + ".localhost"));
+        }
+        // Returns the post-reset redirect so callers can assert the carried signup redirect.
+        return mockMvc.perform(reset)
+                .andExpect(status().isFound())
+                .andReturn()
+                .getResponse()
+                .getRedirectedUrl();
+    }
+
     private ResultActions loginWithAccount(String subdomain) throws Exception {
 
         MockHttpServletRequestBuilder req = post("/login.do")
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java
index e510aedcc09..7177ffcb315 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/AccountsControllerMockMvcZonePathTests.java
@@ -1,5 +1,7 @@
 package org.cloudfoundry.identity.uaa.login;
 
+import jakarta.mail.Message;
+import java.nio.charset.StandardCharsets;
 import org.apache.commons.lang3.RandomStringUtils;
 import org.cloudfoundry.identity.uaa.DefaultTestContext;
 import org.cloudfoundry.identity.uaa.account.EmailAccountCreationService;
@@ -45,9 +47,12 @@
 import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
 import org.springframework.web.context.WebApplicationContext;
 import org.springframework.web.context.support.StandardServletEnvironment;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
 import org.cloudfoundry.identity.uaa.extensions.EnabledIfZonePathsEnabled;
 
 import java.util.Collections;
+import org.springframework.web.util.UriUtils;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils.CookieCsrfPostProcessor.cookieCsrf;
@@ -61,12 +66,12 @@
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.view;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.xpath;
 import static org.springframework.util.StringUtils.hasLength;
+import static org.springframework.util.StringUtils.hasText;
 
 @DefaultTestContext
 @EnabledIfZonePathsEnabled
 class AccountsControllerMockMvcZonePathTests {
 
-    private static final String LOGIN_REDIRECT = "/login?success=verify_success";
     private static final String USER_PASSWORD = "secr3T";
     private final AlphanumericRandomValueStringGenerator generator = new AlphanumericRandomValueStringGenerator();
     private String userEmail;
@@ -149,6 +154,81 @@ void activationEmailSentPageWithinZone(ZoneResolutionMode mode) throws Exception
         assertThat(result.getResponse().getContentAsString()).contains("Create your account", "Cloud Foundry");
     }
 
+    @ParameterizedTest
+    @EnumSource(ZoneResolutionMode.class)
+    void creatingAnAccountInAnotherZoneShowsTheEmailOnTheConfirmationPage(ZoneResolutionMode mode) throws Exception {
+        useRandomActivationCodes();
+        String subdomain = generator.generate();
+        MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, IdentityZoneHolder.getCurrentZoneId());
+
+        MockHttpSession session = new MockHttpSession();
+        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/create_account.do")
+                        .with(cookieCsrf())
+                        .session(session)
+                        .param("email", userEmail)
+                        .param("password", USER_PASSWORD)
+                        .param("password_confirmation", USER_PASSWORD))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+
+        MvcResult page = mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/accounts/email_sent")
+                        .session(session))
+                .andExpect(status().isOk())
+                .andReturn();
+
+        assertThat(page.getResponse().getContentAsString()).contains(userEmail);
+    }
+
+    @ParameterizedTest
+    @EnumSource(ZoneResolutionMode.class)
+    void creatingAnAccountInAnotherZoneForAnExistingVerifiedUserRedirectsLikeANewAddress(ZoneResolutionMode mode) throws Exception {
+        useRandomActivationCodes();
+        String subdomain = generator.generate();
+        IdentityZone zone = MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, IdentityZoneHolder.getCurrentZoneId());
+        createVerifiedUaaUser(userEmail, zone.getId());
+
+        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/create_account.do")
+                        .with(cookieCsrf())
+                        .param("email", userEmail)
+                        .param("password", USER_PASSWORD)
+                        .param("password_confirmation", USER_PASSWORD))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+    }
+
+    @ParameterizedTest
+    @EnumSource(ZoneResolutionMode.class)
+    void creatingAnAccountInAnotherZoneForAnExistingVerifiedUserMailsTheOwnerWithoutAnActivationLink(ZoneResolutionMode mode) throws Exception {
+        useRandomActivationCodes();
+        String subdomain = generator.generate();
+        IdentityZone zone = MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, IdentityZoneHolder.getCurrentZoneId());
+        createVerifiedUaaUser(userEmail, zone.getId());
+
+        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/create_account.do")
+                .with(cookieCsrf())
+                .param("email", userEmail)
+                .param("password", USER_PASSWORD)
+                .param("password_confirmation", USER_PASSWORD));
+
+        assertThat(fakeJavaMailSender.getSentMessages()).hasSize(1);
+        FakeJavaMailSender.MimeMessageWrapper message = fakeJavaMailSender.getSentMessages().getFirst();
+        assertThat(message.getRecipients(Message.RecipientType.TO)).hasSize(1);
+        assertThat(message.getRecipients(Message.RecipientType.TO).getFirst()).hasToString(userEmail);
+        assertThat(message.getContentString()).doesNotContain("verify_user");
+    }
+
+    private void useRandomActivationCodes() {
+        webApplicationContext.getBean(JdbcExpiringCodeStore.class).setGenerator(new AlphanumericRandomValueStringGenerator(24));
+    }
+
+    private void createVerifiedUaaUser(String email, String zoneId) {
+        ScimUser existing = new ScimUser(null, email, "Given", "Family");
+        existing.setPrimaryEmail(email);
+        existing.setOrigin(OriginKeys.UAA);
+        existing.setVerified(true);
+        webApplicationContext.getBean(JdbcScimUserProvisioning.class).createUser(existing, USER_PASSWORD, zoneId);
+    }
+
     /**
      * accounts/email_sent page must render "Resend activation email" link zone-aware.
      * Passes for SUBDOMAIN; will pass for ZONE_PATH once template/controller are zone path aware.
@@ -303,11 +383,7 @@ void creatingAnAccount() throws Exception {
         ScimUser scimUser = scimUserProvisioning.query("userName eq '" + userEmail + "' and origin eq '" + OriginKeys.UAA + "'", IdentityZoneHolder.get().getId()).getFirst();
         assertThat(scimUser.isVerified()).isFalse();
 
-        mockMvc.perform(get("/verify_user")
-                        .param("code", "test" + generator.counter.get()))
-                .andExpect(status().isFound())
-                .andExpect(redirectedUrl(LOGIN_REDIRECT))
-                .andReturn();
+        confirmAccountAndSetPassword(ZoneResolutionMode.SUBDOMAIN, "", "test" + generator.counter.get(), userEmail);
 
         MvcResult mvcResult = loginWithAccount("")
                 .andExpect(authenticated())
@@ -321,6 +397,45 @@ void creatingAnAccount() throws Exception {
         assertThat(principal.getOrigin()).isEqualTo(OriginKeys.UAA);
     }
 
+    @ParameterizedTest
+    @EnumSource(ZoneResolutionMode.class)
+    void openingAnotherActivationLinkInAnotherZoneAfterPasswordSetupKeepsThePassword(ZoneResolutionMode mode) throws Exception {
+        String subdomain = generator.generate();
+        MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, IdentityZoneHolder.getCurrentZoneId());
+        PredictableGenerator codes = new PredictableGenerator();
+        webApplicationContext.getBean(JdbcExpiringCodeStore.class).setGenerator(codes);
+
+        // Two registrations for the same unconfirmed address send two activation links.
+        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/create_account.do")
+                        .with(cookieCsrf())
+                        .param("email", userEmail)
+                        .param("password", "firstPass1")
+                        .param("password_confirmation", "firstPass1"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+        String firstActivationCode = "test" + codes.counter.get();
+
+        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/create_account.do")
+                        .with(cookieCsrf())
+                        .param("email", userEmail)
+                        .param("password", "laterPass2")
+                        .param("password_confirmation", "laterPass2"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+        String secondActivationCode = "test" + codes.counter.get();
+
+        // The owner confirms with the second link and sets a password.
+        confirmAccountAndSetPassword(mode, subdomain, secondActivationCode, userEmail);
+
+        // Opening the first link afterwards must not replace that password.
+        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/verify_user")
+                        .param("code", firstActivationCode))
+                .andExpect(status().isFound());
+
+        loginWithAccount(mode, subdomain)
+                .andExpect(authenticated());
+    }
+
     @Test
     void creatingAnAccountWithAnEmptyClientId() throws Exception {
         PredictableGenerator generator = new PredictableGenerator();
@@ -336,11 +451,7 @@ void creatingAnAccountWithAnEmptyClientId() throws Exception {
                 .andExpect(status().isFound())
                 .andExpect(redirectedUrl("accounts/email_sent"));
 
-        mockMvc.perform(get("/verify_user")
-                        .param("code", "test" + generator.counter.get()))
-                .andExpect(status().isFound())
-                .andExpect(redirectedUrl(LOGIN_REDIRECT))
-                .andReturn();
+        confirmAccountAndSetPassword(ZoneResolutionMode.SUBDOMAIN, "", "test" + generator.counter.get(), userEmail);
 
         MvcResult mvcResult = loginWithAccount("")
                 .andExpect(authenticated())
@@ -359,11 +470,40 @@ void creatingAnAccountWithClientRedirect() throws Exception {
         createAccount("http://redirect.uri/client", "http://redirect.uri/client");
     }
 
+    @Test
+    void creatingAnAccountKeepsClientRedirectWithQueryAsOneFormRedirectParameter() throws Exception {
+        createAccount("http://redirect.uri/page?first=1&second=2#fragment", "http://redirect.uri/page?first=1&second=2#fragment");
+    }
+
     @Test
     void creatingAnAccountWithFallbackClientRedirect() throws Exception {
         createAccount("http://redirect.uri/fallback", null);
     }
 
+    @Test
+    void creatingAnAccountWithFallbackClientRedirectThatIsNotARegisteredRedirectUri() throws Exception {
+        PredictableGenerator generator = new PredictableGenerator();
+        JdbcExpiringCodeStore store = webApplicationContext.getBean(JdbcExpiringCodeStore.class);
+        store.setGenerator(generator);
+        // the client's redirect URIs are http://redirect.uri/*, so this fallback matches none of them
+        UaaClientDetails clientDetails = createTestClient("http://other.uri/after-signup");
+
+        mockMvc.perform(post("/create_account.do")
+                        .with(cookieCsrf())
+                        .param("email", userEmail)
+                        .param("password", USER_PASSWORD)
+                        .param("password_confirmation", USER_PASSWORD)
+                        .param("client_id", clientDetails.getClientId()))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("accounts/email_sent"));
+
+        String afterReset = confirmAccountAndSetPassword(ZoneResolutionMode.SUBDOMAIN, "", "test" + generator.counter.get(), userEmail);
+
+        // signup_redirect_url is set on the client by an administrator, so it applies after the
+        // password is set even when it is not one of the client's registered redirect URIs.
+        assertRedirectsToLoginWithSingleFormRedirectUri(afterReset, "http://other.uri/after-signup");
+    }
+
     @Test
     void creatingAnAccountWithNoClientRedirect() throws Exception {
         PredictableGenerator generator = new PredictableGenerator();
@@ -382,11 +522,7 @@ void creatingAnAccountWithNoClientRedirect() throws Exception {
         assertThat(message.getContentString()).contains("Cloud Foundry");
         assertThat(message.getMessage().getHeader("From")).contains("Cloud Foundry <admin@localhost>");
 
-        mockMvc.perform(get("/verify_user")
-                        .param("code", "test" + generator.counter.get()))
-                .andExpect(status().isFound())
-                .andExpect(redirectedUrl(LOGIN_REDIRECT))
-                .andReturn();
+        confirmAccountAndSetPassword(ZoneResolutionMode.SUBDOMAIN, "", "test" + generator.counter.get(), userEmail);
 
         MvcResult mvcResult = loginWithAccount("")
                 .andExpect(authenticated())
@@ -441,12 +577,7 @@ void creatingAnAccountInAnotherZoneWithNoClientRedirect(ZoneResolutionMode mode)
             assertThat(link).contains(subdomain + ".localhost");
         }
 
-        String expectedVerifyRedirect = mode == ZoneResolutionMode.ZONE_PATH ? "/z/" + subdomain + "/login?success=verify_success" : LOGIN_REDIRECT;
-        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/verify_user")
-                        .param("code", "test" + generator.counter.get()))
-                .andExpect(status().isFound())
-                .andExpect(redirectedUrl(expectedVerifyRedirect))
-                .andReturn();
+        confirmAccountAndSetPassword(mode, subdomain, "test" + generator.counter.get(), userEmail);
 
         MvcResult mvcResult = loginWithAccount(subdomain)
                 .andExpect(redirectedUrl("/"))
@@ -495,13 +626,8 @@ void creatingAnAccountInAnotherZoneWithClientRedirect(ZoneResolutionMode mode) t
             assertThat(link).contains(subdomain + ".localhost");
         }
 
-        String expectedVerifyRedirect = mode == ZoneResolutionMode.ZONE_PATH
-                ? "/z/" + subdomain + "/login?success=verify_success&form_redirect_uri=http://myzoneclient.example.com"
-                : LOGIN_REDIRECT + "&form_redirect_uri=http://myzoneclient.example.com";
-        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/verify_user")
-                        .param("code", "test" + generator.counter.get()))
-                .andExpect(redirectedUrl(expectedVerifyRedirect))
-                .andReturn();
+        String afterReset = confirmAccountAndSetPassword(mode, subdomain, "test" + generator.counter.get(), userEmail);
+        assertRedirectsToLoginWithSingleFormRedirectUri(afterReset, "http://myzoneclient.example.com");
 
         MvcResult mvcResult = loginWithAccount(subdomain)
                 .andExpect(authenticated())
@@ -540,14 +666,29 @@ void redirectToSavedRequest_ifPresent() throws Exception {
                         .param("password_confirmation", "test-password"))
                 .andExpect(redirectedUrl("accounts/email_sent"));
 
-        mockMvc.perform(get("/verify_user")
+        MvcResult verifyResult = mockMvc.perform(get("/verify_user")
                         .session(session)
                         .param("code", "test" + generator.counter.get()))
                 .andExpect(status().isFound())
-                .andExpect(redirectedUrl(LOGIN_REDIRECT))
                 .andReturn();
 
+        String location = verifyResult.getResponse().getRedirectedUrl();
+        assertThat(location)
+                .startsWith("/reset_password?code=")
+                .contains("force_change=true");
+
         assertThat(SessionUtils.getSavedRequestSession(MockMvcUtils.getZoneSession(session)).getRedirectUrl()).isNotNull();
+
+        // Consume the reset code so the predictable code sequence does not collide with later tests.
+        String resetCode = UriComponentsBuilder.fromUriString(location).build().getQueryParams().getFirst("code");
+        mockMvc.perform(post("/reset_password.do")
+                        .with(cookieCsrf())
+                        .session(session)
+                        .param("code", resetCode)
+                        .param("email", "testuser@test.org")
+                        .param("password", USER_PASSWORD)
+                        .param("password_confirmation", USER_PASSWORD))
+                .andExpect(status().isFound());
     }
 
     @Test
@@ -635,13 +776,26 @@ void consentIfConfiguredDisplaysMeaningfulErrorWhenConsentNotProvided(ZoneResolu
         assertThat(result.getResponse().getContentAsString()).contains("Please agree before continuing.");
     }
 
+    private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) {
+        UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build();
+        assertThat(redirect.getPath()).endsWith("/login");
+        assertThat(redirect.getFragment()).isNull();
+        assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri");
+        assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("password_reset");
+        assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri);
+    }
+
     private UaaClientDetails createTestClient() throws Exception {
+        return createTestClient("http://redirect.uri/fallback");
+    }
+
+    private UaaClientDetails createTestClient(String signupRedirectUrl) throws Exception {
         UaaClientDetails clientDetails = new UaaClientDetails();
         clientDetails.setClientId("test-client-" + RandomStringUtils.randomAlphanumeric(200));
         clientDetails.setClientSecret("test-client-secret");
         clientDetails.setAuthorizedGrantTypes(Collections.singletonList("client_credentials"));
         clientDetails.setRegisteredRedirectUri(Collections.singleton("http://redirect.uri/*"));
-        clientDetails.addAdditionalInformation(EmailAccountCreationService.SIGNUP_REDIRECT_URL, "http://redirect.uri/fallback");
+        clientDetails.addAdditionalInformation(EmailAccountCreationService.SIGNUP_REDIRECT_URL, signupRedirectUrl);
 
         UaaTestAccounts testAccounts = UaaTestAccounts.standard(null);
         String adminToken = testClient.getClientCredentialsOAuthAccessToken(testAccounts.getAdminClientId(),
@@ -669,11 +823,8 @@ private void createAccount(String expectedRedirectUri, String redirectUri) throw
         assertThat(message.getContentString()).contains("Cloud Foundry");
         assertThat(message.getMessage().getHeader("From")).contains("Cloud Foundry <admin@localhost>");
 
-        mockMvc.perform(get("/verify_user")
-                        .param("code", "test" + generator.counter.get()))
-                .andExpect(status().isFound())
-                .andExpect(redirectedUrl(LOGIN_REDIRECT + "&form_redirect_uri=" + expectedRedirectUri))
-                .andReturn();
+        String afterReset = confirmAccountAndSetPassword(ZoneResolutionMode.SUBDOMAIN, "", "test" + generator.counter.get(), userEmail);
+        assertRedirectsToLoginWithSingleFormRedirectUri(afterReset, expectedRedirectUri);
 
         MvcResult mvcResult = loginWithAccount("")
                 .andExpect(authenticated())
@@ -687,6 +838,39 @@ private void createAccount(String expectedRedirectUri, String redirectUri) throw
         assertThat(principal.getOrigin()).isEqualTo(OriginKeys.UAA);
     }
 
+    /**
+     * Account confirmation no longer leaves a usable password: clicking the activation link sends
+     * the owner to the reset-password page to establish their own password. This helper completes
+     * that flow (zone-resolution aware), confirming the account via {@code /verify_user} and setting
+     * the password to {@link #USER_PASSWORD} so the account can then be used to log in.
+     */
+    private String confirmAccountAndSetPassword(ZoneResolutionMode mode, String subdomain, String activationCode, String email) throws Exception {
+        MvcResult verifyResult = mockMvc.perform(mode.createRequestBuilder(subdomain != null ? subdomain : "", HttpMethod.GET, "/verify_user")
+                        .param("code", activationCode))
+                .andExpect(status().isFound())
+                .andReturn();
+
+        String location = verifyResult.getResponse().getRedirectedUrl();
+        String expectedPrefix = (mode == ZoneResolutionMode.ZONE_PATH && hasText(subdomain))
+                ? "/z/" + subdomain + "/reset_password?code=" : "/reset_password?code=";
+        assertThat(location)
+                .startsWith(expectedPrefix)
+                .contains("force_change=true");
+        String resetCode = UriComponentsBuilder.fromUriString(location).build().getQueryParams().getFirst("code");
+
+        // Returns the post-reset redirect so callers can assert the carried signup redirect.
+        return mockMvc.perform(mode.createRequestBuilder(subdomain != null ? subdomain : "", HttpMethod.POST, "/reset_password.do")
+                        .with(cookieCsrf())
+                        .param("code", resetCode)
+                        .param("email", email)
+                        .param("password", USER_PASSWORD)
+                        .param("password_confirmation", USER_PASSWORD))
+                .andExpect(status().isFound())
+                .andReturn()
+                .getResponse()
+                .getRedirectedUrl();
+    }
+
     private ResultActions loginWithAccount(String subdomain) throws Exception {
         return loginWithAccount(ZoneResolutionMode.SUBDOMAIN, subdomain);
     }
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerMockMvcTest.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerMockMvcTest.java
index 4863bd7707b..55c5d28a93e 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerMockMvcTest.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerMockMvcTest.java
@@ -22,16 +22,17 @@
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.MethodSource;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.mock.web.MockHttpSession;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
 import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.MvcResult;
 import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
 import org.springframework.web.context.WebApplicationContext;
 
 import jakarta.servlet.http.Cookie;
-import jakarta.servlet.http.HttpSession;
 import java.util.Date;
 import java.util.stream.Stream;
 
@@ -264,6 +265,39 @@ void submit_password_change_when_not_authenticated() throws Exception {
                 .andExpect(redirectedUrl("/login"));
     }
 
+    @ParameterizedTest
+    @ValueSource(strings = {"/force_password_change", "/force_password_change/"})
+    void submit_password_change_when_no_change_is_pending(String path) throws Exception {
+        MockHttpSession session = new MockHttpSession();
+        mockMvc.perform(post("/login.do")
+                        .param("username", user.getUserName())
+                        .param("password", "secret")
+                        .session(session)
+                        .with(cookieCsrf())
+                        .param(CookieBasedCsrfTokenRepository.DEFAULT_CSRF_COOKIE_NAME, "csrf1"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("/"));
+        assertThat(SessionUtils.isPasswordChangeRequired(MockMvcUtils.getZoneSession(session))).isFalse();
+
+        MvcResult submitResult = mockMvc.perform(post(path)
+                        .param("password", "test")
+                        .param("password_confirmation", "test")
+                        .session(session)
+                        .with(cookieCsrf()))
+                .andExpect(status().isFound())
+                .andReturn();
+
+        mockMvc.perform(post("/login.do")
+                        .param("username", user.getUserName())
+                        .param("password", "secret")
+                        .session(new MockHttpSession())
+                        .with(cookieCsrf())
+                        .param(CookieBasedCsrfTokenRepository.DEFAULT_CSRF_COOKIE_NAME, "csrf1"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("/"));
+        assertThat(submitResult.getResponse().getRedirectedUrl()).isEqualTo("/");
+    }
+
     static class PasswordPolicyWithInvalidPassword {
         PasswordPolicy passwordPolicy;
         String password;
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerZonePathMockMvcTest.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerZonePathMockMvcTest.java
index 0b8ed5893d9..b3ce39adc17 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerZonePathMockMvcTest.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ForcePasswordChangeControllerZonePathMockMvcTest.java
@@ -331,6 +331,47 @@ void submit_password_change_when_not_authenticated(ZoneResolutionMode mode) thro
                 .andExpect(redirectedUrl(expectedRedirect));
     }
 
+    @ParameterizedTest
+    @MethodSource("zoneModesWithForcePasswordChangePaths")
+    void submit_password_change_when_no_change_is_pending(ZoneResolutionMode mode, String path) throws Exception {
+        setupZoneAndUser(mode);
+        String expectedRedirect = mode == ZoneResolutionMode.ZONE_PATH ? "/z/" + subdomain + "/" : "/";
+
+        MockHttpSession session = new MockHttpSession();
+        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/login.do")
+                        .param("username", user.getUserName())
+                        .param("password", "secret")
+                        .session(session)
+                        .with(cookieCsrf())
+                        .param(CookieBasedCsrfTokenRepository.DEFAULT_CSRF_COOKIE_NAME, "csrf1"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl(expectedRedirect));
+        assertThat(SessionUtils.isPasswordChangeRequired(MockMvcUtils.getZoneSession(session, mode, subdomain))).isFalse();
+
+        MvcResult submitResult = mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, path)
+                        .param("password", "test")
+                        .param("password_confirmation", "test")
+                        .session(session)
+                        .with(cookieCsrf()))
+                .andExpect(status().isFound())
+                .andReturn();
+
+        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/login.do")
+                        .param("username", user.getUserName())
+                        .param("password", "secret")
+                        .session(new MockHttpSession())
+                        .with(cookieCsrf())
+                        .param(CookieBasedCsrfTokenRepository.DEFAULT_CSRF_COOKIE_NAME, "csrf1"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl(expectedRedirect));
+        assertThat(submitResult.getResponse().getRedirectedUrl()).isEqualTo(expectedRedirect);
+    }
+
+    static Stream<Arguments> zoneModesWithForcePasswordChangePaths() {
+        return Stream.of(ZoneResolutionMode.values())
+                .flatMap(mode -> Stream.of("/force_password_change", "/force_password_change/").map(path -> Arguments.of(mode, path)));
+    }
+
     static Stream<Arguments> authenticationTestParamsWithZoneModes() {
         return ForcePasswordChangeControllerMockMvcTest.authenticationTestParams()
                 .flatMap(pp -> Stream.of(ZoneResolutionMode.values()).map(mode -> Arguments.of(pp, mode)));
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcTests.java
index b79a8b1782c..9794c77da1c 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcTests.java
@@ -14,6 +14,7 @@
 
 package org.cloudfoundry.identity.uaa.login;
 
+import java.nio.charset.StandardCharsets;
 import org.cloudfoundry.identity.uaa.DefaultTestContext;
 import org.cloudfoundry.identity.uaa.client.UaaClientDetails;
 import org.cloudfoundry.identity.uaa.constants.OriginKeys;
@@ -48,6 +49,9 @@
 import java.net.URL;
 import java.util.Arrays;
 import java.util.Collections;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
+import org.springframework.web.util.UriUtils;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils.CookieCsrfPostProcessor.cookieCsrf;
@@ -350,8 +354,8 @@ void acceptInvitationSetsYourPassword() throws Exception {
                         post
                 )
                 .andExpect(status().isFound())
-                .andExpect(redirectedUrl("/login?success=invite_accepted&form_redirect_uri=" + REDIRECT_URI))
                 .andReturn();
+        assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), REDIRECT_URI);
 
         assertThat(queryUserForField(jdbcTemplate, email, "verified", Boolean.class)).as("User should be verified after password reset").isTrue();
 
@@ -365,6 +369,42 @@ void acceptInvitationSetsYourPassword() throws Exception {
                 .andExpect(redirectedUrl("/login"));
     }
 
+    @Test
+    void acceptInvitationKeepsRedirectUrlWithQueryAsOneFormRedirectParameter() throws Exception {
+        String adminToken = MockMvcUtils.getClientCredentialsOAuthAccessToken(mockMvc, "admin", "adminsecret", "clients.admin clients.read clients.write clients.secret scim.read scim.write", null);
+        String patternClientId = generator.generate().toLowerCase();
+        String patternClientSecret = generator.generate().toLowerCase();
+        MockMvcUtils.createClient(this.mockMvc, adminToken, patternClientId, patternClientSecret, Collections.singleton("oauth"), Arrays.asList("scim.read", "scim.invite"), Arrays.asList("client_credentials", "password"), "scim.read,scim.invite", Collections.singleton(REDIRECT_URI + "/**"), IdentityZone.getUaa());
+        String patternInviteToken = MockMvcUtils.getScimInviteUserToken(mockMvc, patternClientId, patternClientSecret, null, "admin", "adminsecret");
+        String redirectUri = REDIRECT_URI + "/page?first=1&second=2#fragment";
+
+        String email = generator.generate().toLowerCase() + "@test.org";
+        URL inviteLink = MockMvcUtils.inviteUser(webApplicationContext, mockMvc, email, patternInviteToken, null, patternClientId, OriginKeys.UAA, redirectUri);
+
+        String code = extractInvitationCode(inviteLink.toString());
+        MvcResult result = mockMvc.perform(get("/invitations/accept")
+                        .param("code", code)
+                        .accept(MediaType.TEXT_HTML))
+                .andExpect(status().isOk())
+                .andReturn();
+
+        code = jdbcTemplate.queryForObject("SELECT code FROM expiring_code_store", String.class);
+        MockHttpSession session = (MockHttpSession) result.getRequest().getSession(false);
+        MockHttpServletRequestBuilder post = post("/invitations/accept.do")
+                .param("password", "s3cret")
+                .param("password_confirmation", "s3cret")
+                .param("code", code)
+                .with(cookieCsrf());
+        if (session != null) {
+            post = post.session(session);
+        }
+        result = mockMvc.perform(post)
+                .andExpect(status().isFound())
+                .andReturn();
+
+        assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), redirectUri);
+    }
+
     @Test
     void inviteLdapUsersVerifiesAndRedirects() throws Exception {
         ZoneScimInviteData zone = createZoneForInvites(mockMvc, webApplicationContext, clientId);
@@ -425,6 +465,15 @@ void inviteSamlUserWillRedirectUponAccept() throws Exception {
         assertThat(queryUserForField(jdbcTemplate, email, "verified", Boolean.class)).as("Saml user should not yet be verified after clicking on the accept link").isFalse();
     }
 
+    private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) {
+        UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build();
+        assertThat(redirect.getPath()).endsWith("/login");
+        assertThat(redirect.getFragment()).isNull();
+        assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri");
+        assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("invite_accepted");
+        assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri);
+    }
+
     private static <T> T queryUserForField(JdbcTemplate jdbcTemplate, String email, String field, Class<T> type) {
         return jdbcTemplate.queryForObject("SELECT " + field + " FROM users WHERE email=?", type, email);
     }
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcZonePathTests.java
index 2ecbf9f86d9..c5ccc72ffba 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcZonePathTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/InvitationsServiceMockMvcZonePathTests.java
@@ -14,6 +14,7 @@
 
 package org.cloudfoundry.identity.uaa.login;
 
+import java.nio.charset.StandardCharsets;
 import org.cloudfoundry.identity.uaa.DefaultTestContext;
 import org.cloudfoundry.identity.uaa.client.UaaClientDetails;
 import org.cloudfoundry.identity.uaa.constants.OriginKeys;
@@ -60,6 +61,9 @@
 import org.cloudfoundry.identity.uaa.util.JsonUtils;
 
 import java.net.URL;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
+import org.springframework.web.util.UriUtils;
 
 import static org.cloudfoundry.identity.uaa.oauth.common.util.OAuth2Utils.CLIENT_ID;
 import static org.springframework.http.MediaType.APPLICATION_JSON;
@@ -628,8 +632,8 @@ void acceptInvitationSetsYourPassword() throws Exception {
                         post
                 )
                 .andExpect(status().isFound())
-                .andExpect(redirectedUrl("/login?success=invite_accepted&form_redirect_uri=" + REDIRECT_URI))
                 .andReturn();
+        assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), REDIRECT_URI);
 
         assertThat(queryUserForField(jdbcTemplate, email, "verified", Boolean.class)).as("User should be verified after password reset").isTrue();
 
@@ -762,6 +766,15 @@ void inviteSamlUserWillRedirectUponAccept() throws Exception {
         assertThat(queryUserForField(jdbcTemplate, email, "verified", Boolean.class)).as("Saml user should not yet be verified after clicking on the accept link").isFalse();
     }
 
+    private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) {
+        UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build();
+        assertThat(redirect.getPath()).endsWith("/login");
+        assertThat(redirect.getFragment()).isNull();
+        assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri");
+        assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("invite_accepted");
+        assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri);
+    }
+
     private static <T> T queryUserForField(JdbcTemplate jdbcTemplate, String email, String field, Class<T> type) {
         return jdbcTemplate.queryForObject("SELECT " + field + " FROM users WHERE email=?", type, email);
     }
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcTests.java
index 2f39d6ceca8..fb44627b094 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcTests.java
@@ -10,6 +10,7 @@
 import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore;
 import org.cloudfoundry.identity.uaa.codestore.JdbcExpiringCodeStore;
 import org.cloudfoundry.identity.uaa.impl.config.IdentityZoneConfigurationBootstrap;
+import org.cloudfoundry.identity.uaa.message.util.FakeJavaMailSender;
 import org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils;
 import org.cloudfoundry.identity.uaa.oauth.client.ClientConstants;
 import org.cloudfoundry.identity.uaa.oauth.common.util.RandomValueStringGenerator;
@@ -73,7 +74,9 @@
 import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
 import org.springframework.util.StringUtils;
 import org.springframework.web.context.WebApplicationContext;
+import org.springframework.web.util.UriComponents;
 import org.springframework.web.util.UriComponentsBuilder;
+import org.springframework.web.util.UriUtils;
 
 import java.io.File;
 import java.net.URI;
@@ -2032,6 +2035,94 @@ void changeEmailSubmitWithCorrectCsrf() throws Exception {
 
     }
 
+    @Test
+    void changeEmailVerificationGoesToProfileWhenClientHasNoRedirectUrisAndRequestedUriIsNotRegistered() throws Exception {
+        assumeFalse(isLimitedMode(limitedModeUaaFilter.getFilter()), "Test only runs in non limited mode.");
+        String username = generator.generate() + "@testdomain.com";
+        createUser(scimUserProvisioning, username, IdentityZone.getUaaZoneId());
+        SecurityContext userContext = getUaaSecurityContext(username, webApplicationContext, IdentityZoneHolder.getCurrentZoneId());
+
+        String clientId = generator.generate();
+        UaaClientDetails client = new UaaClientDetails(clientId, "", "", "client_credentials", "uaa.none");
+        client.setClientSecret(clientId);
+        MockMvcUtils.createClient(webApplicationContext, client, getUaa());
+
+        FakeJavaMailSender sender = webApplicationContext.getBean(FakeJavaMailSender.class);
+        sender.clearMessage();
+
+        MockHttpSession session = (MockHttpSession) mockMvc.perform(get("/change_email")
+                        .accept(TEXT_HTML)
+                        .with(securityContext(userContext)))
+                .andExpect(status().isOk())
+                .andReturn().getRequest().getSession();
+
+        mockMvc.perform(post("/change_email.do")
+                        .accept(TEXT_HTML)
+                        .session(session)
+                        .with(securityContext(userContext))
+                        .with(cookieCsrf())
+                        .param("newEmail", generator.generate() + "@testdomain.com")
+                        .param("client_id", clientId)
+                        .param("redirect_uri", "http://other.example.com/page"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("email_sent?code=email_change"));
+
+        Matcher matcher = Pattern.compile("verify_email\\?code=([A-Za-z0-9_-]+)").matcher(sender.getSentMessages().getFirst().getContentString());
+        assertThat(matcher.find()).isTrue();
+
+        mockMvc.perform(get("/verify_email")
+                        .accept(TEXT_HTML)
+                        .session(session)
+                        .with(securityContext(userContext))
+                        .param("code", matcher.group(1)))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("profile?success_message_code=email_change.success"));
+    }
+
+    @Test
+    void changeEmailVerificationKeepsRedirectUrlAsOneFormRedirectParameterWhenNotSignedIn() throws Exception {
+        assumeFalse(isLimitedMode(limitedModeUaaFilter.getFilter()), "Test only runs in non limited mode.");
+        String username = generator.generate() + "@testdomain.com";
+        createUser(scimUserProvisioning, username, IdentityZone.getUaaZoneId());
+        SecurityContext userContext = getUaaSecurityContext(username, webApplicationContext, IdentityZoneHolder.getCurrentZoneId());
+
+        String clientId = generator.generate();
+        UaaClientDetails client = new UaaClientDetails(clientId, "", "", "client_credentials", "uaa.none", "http://app.example.com/**");
+        client.setClientSecret(clientId);
+        MockMvcUtils.createClient(webApplicationContext, client, getUaa());
+
+        FakeJavaMailSender sender = webApplicationContext.getBean(FakeJavaMailSender.class);
+        sender.clearMessage();
+
+        MockHttpSession session = (MockHttpSession) mockMvc.perform(get("/change_email")
+                        .accept(TEXT_HTML)
+                        .with(securityContext(userContext)))
+                .andExpect(status().isOk())
+                .andReturn().getRequest().getSession();
+
+        mockMvc.perform(post("/change_email.do")
+                        .accept(TEXT_HTML)
+                        .session(session)
+                        .with(securityContext(userContext))
+                        .with(cookieCsrf())
+                        .param("newEmail", generator.generate() + "@testdomain.com")
+                        .param("client_id", clientId)
+                        .param("redirect_uri", "http://app.example.com/page?first=1&second=2#fragment"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("email_sent?code=email_change"));
+
+        Matcher matcher = Pattern.compile("verify_email\\?code=([A-Za-z0-9_-]+)").matcher(sender.getSentMessages().getFirst().getContentString());
+        assertThat(matcher.find()).isTrue();
+
+        MvcResult result = mockMvc.perform(get("/verify_email")
+                        .accept(TEXT_HTML)
+                        .param("code", matcher.group(1)))
+                .andExpect(status().isFound())
+                .andReturn();
+
+        assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), "http://app.example.com/page?first=1&second=2#fragment");
+    }
+
     @Test
     void changeEmailDoNotLoggedIn() throws Exception {
         assumeFalse(isLimitedMode(limitedModeUaaFilter.getFilter()), "Test only runs in non limited mode.");
@@ -3061,6 +3152,15 @@ public Map<String, String[]> getParameterMap() {
         };
     }
 
+    private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) {
+        UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build();
+        assertThat(redirect.getPath()).endsWith("login");
+        assertThat(redirect.getFragment()).isNull();
+        assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri");
+        assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("change_email_success");
+        assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri);
+    }
+
     private static ScimUser createUser(ScimUserProvisioning scimUserProvisioning, AlphanumericRandomValueStringGenerator generator, String zoneId) {
         String username = generator.generate() + "@testdomain.com";
         return createUser(scimUserProvisioning, username, zoneId);
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcZonePathTests.java
index a84fe9c23dc..0d7249d64e6 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcZonePathTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcZonePathTests.java
@@ -10,6 +10,7 @@
 import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore;
 import org.cloudfoundry.identity.uaa.codestore.JdbcExpiringCodeStore;
 import org.cloudfoundry.identity.uaa.impl.config.IdentityZoneConfigurationBootstrap;
+import org.cloudfoundry.identity.uaa.message.util.FakeJavaMailSender;
 import org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils;
 import org.cloudfoundry.identity.uaa.oauth.client.ClientConstants;
 import org.cloudfoundry.identity.uaa.oauth.common.util.RandomValueStringGenerator;
@@ -77,7 +78,9 @@
 import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
 import org.springframework.util.StringUtils;
 import org.springframework.web.context.WebApplicationContext;
+import org.springframework.web.util.UriComponents;
 import org.springframework.web.util.UriComponentsBuilder;
+import org.springframework.web.util.UriUtils;
 import org.cloudfoundry.identity.uaa.extensions.EnabledIfZonePathsEnabled;
 
 import java.io.File;
@@ -359,6 +362,98 @@ void access_login_page_while_logged_in(ZoneResolutionMode mode) throws Exception
                 .andExpect(redirectedUrl(expectedRedirect));
     }
 
+    @ParameterizedTest
+    @EnumSource(ZoneResolutionMode.class)
+    void changeEmailVerificationGoesToProfileWhenClientHasNoRedirectUrisAndRequestedUriIsNotRegistered(ZoneResolutionMode mode) throws Exception {
+        assumeFalse(isLimitedMode(limitedModeUaaFilter.getFilter()), "Zone creation returns 503 in limited mode.");
+        String subdomain = new AlphanumericRandomValueStringGenerator(24).generate().toLowerCase();
+        IdentityZone zone = MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, false, IdentityZoneHolder.getCurrentZoneId());
+        ScimUser zoneUser = createUser(scimUserProvisioning, generator, zone.getId());
+        SecurityContext userContext = getUaaSecurityContext(zoneUser.getUserName(), webApplicationContext, zone.getId());
+
+        String clientId = generator.generate();
+        UaaClientDetails client = new UaaClientDetails(clientId, "", "", "client_credentials", "uaa.none");
+        client.setClientSecret(clientId);
+        MockMvcUtils.createClient(webApplicationContext, client, zone);
+
+        FakeJavaMailSender sender = webApplicationContext.getBean(FakeJavaMailSender.class);
+        sender.clearMessage();
+
+        MockHttpSession session = (MockHttpSession) mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/change_email")
+                        .accept(TEXT_HTML)
+                        .with(securityContext(userContext)))
+                .andExpect(status().isOk())
+                .andReturn().getRequest().getSession();
+
+        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/change_email.do")
+                        .accept(TEXT_HTML)
+                        .session(session)
+                        .with(securityContext(userContext))
+                        .with(cookieCsrf())
+                        .param("newEmail", generator.generate() + "@testdomain.com")
+                        .param("client_id", clientId)
+                        .param("redirect_uri", "http://other.example.com/page"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("email_sent?code=email_change"));
+
+        Matcher matcher = Pattern.compile("verify_email\\?code=([A-Za-z0-9_-]+)").matcher(sender.getSentMessages().getFirst().getContentString());
+        assertThat(matcher.find()).isTrue();
+
+        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/verify_email")
+                        .accept(TEXT_HTML)
+                        .session(session)
+                        .with(securityContext(userContext))
+                        .param("code", matcher.group(1)))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("profile?success_message_code=email_change.success"));
+    }
+
+    @ParameterizedTest
+    @EnumSource(ZoneResolutionMode.class)
+    void changeEmailVerificationKeepsRedirectUrlAsOneFormRedirectParameterWhenNotSignedIn(ZoneResolutionMode mode) throws Exception {
+        assumeFalse(isLimitedMode(limitedModeUaaFilter.getFilter()), "Zone creation returns 503 in limited mode.");
+        String subdomain = new AlphanumericRandomValueStringGenerator(24).generate().toLowerCase();
+        IdentityZone zone = MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, false, IdentityZoneHolder.getCurrentZoneId());
+        ScimUser zoneUser = createUser(scimUserProvisioning, generator, zone.getId());
+        SecurityContext userContext = getUaaSecurityContext(zoneUser.getUserName(), webApplicationContext, zone.getId());
+
+        String clientId = generator.generate();
+        UaaClientDetails client = new UaaClientDetails(clientId, "", "", "client_credentials", "uaa.none", "http://app.example.com/**");
+        client.setClientSecret(clientId);
+        MockMvcUtils.createClient(webApplicationContext, client, zone);
+
+        FakeJavaMailSender sender = webApplicationContext.getBean(FakeJavaMailSender.class);
+        sender.clearMessage();
+
+        MockHttpSession session = (MockHttpSession) mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/change_email")
+                        .accept(TEXT_HTML)
+                        .with(securityContext(userContext)))
+                .andExpect(status().isOk())
+                .andReturn().getRequest().getSession();
+
+        mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/change_email.do")
+                        .accept(TEXT_HTML)
+                        .session(session)
+                        .with(securityContext(userContext))
+                        .with(cookieCsrf())
+                        .param("newEmail", generator.generate() + "@testdomain.com")
+                        .param("client_id", clientId)
+                        .param("redirect_uri", "http://app.example.com/page?first=1&second=2#fragment"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("email_sent?code=email_change"));
+
+        Matcher matcher = Pattern.compile("verify_email\\?code=([A-Za-z0-9_-]+)").matcher(sender.getSentMessages().getFirst().getContentString());
+        assertThat(matcher.find()).isTrue();
+
+        MvcResult result = mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.GET, "/verify_email")
+                        .accept(TEXT_HTML)
+                        .param("code", matcher.group(1)))
+                .andExpect(status().isFound())
+                .andReturn();
+
+        assertRedirectsToLoginWithSingleFormRedirectUri(result.getResponse().getRedirectedUrl(), "http://app.example.com/page?first=1&second=2#fragment");
+    }
+
     @ParameterizedTest
     @EnumSource(ZoneResolutionMode.class)
     void invalid_accept_media_type(ZoneResolutionMode mode) throws Exception {
@@ -3670,6 +3765,15 @@ public Map<String, String[]> getParameterMap() {
         };
     }
 
+    private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) {
+        UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build();
+        assertThat(redirect.getPath()).endsWith("login");
+        assertThat(redirect.getFragment()).isNull();
+        assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri");
+        assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("change_email_success");
+        assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri);
+    }
+
     private static ScimUser createUser(ScimUserProvisioning scimUserProvisioning, AlphanumericRandomValueStringGenerator generator, String zoneId) {
         String username = generator.generate() + "@testdomain.com";
         return createUser(scimUserProvisioning, username, zoneId);
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcTests.java
index 9aac6697162..94ef74e642a 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcTests.java
@@ -32,6 +32,7 @@
 import org.springframework.security.web.savedrequest.DefaultSavedRequest;
 import org.springframework.security.web.savedrequest.SavedRequest;
 import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.MvcResult;
 import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
 import org.springframework.web.context.WebApplicationContext;
 
@@ -54,6 +55,7 @@
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.request;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.view;
 
 @DefaultTestContext
 public class ResetPasswordControllerMockMvcTests {
@@ -404,6 +406,42 @@ void resetPassword_ReturnsUnprocessableEntity_NewPasswordNotAccordingToPolicy()
         webApplicationContext.getBean(JdbcIdentityProviderProvisioning.class).update(uaaProvider, uaaProvider.getIdentityZoneId());
     }
 
+    @Test
+    void openingTheResetLinkTwiceStillWorksAndDoesNotExtendTheCodeLifetime() throws Exception {
+        ScimUser user = getScimUser();
+        PasswordChange change = new PasswordChange(user.getId(), user.getUserName(), user.getPasswordLastModified(), "", "");
+        Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + 60_000);
+        ExpiringCode code = codeStore.generateCode(JsonUtils.writeValueAsString(change), expiresAt, FORGOT_PASSWORD_INTENT_PREFIX + user.getId(), IdentityZoneHolder.get().getId());
+
+        mockMvc.perform(get("/reset_password").param("code", code.getCode()))
+                .andExpect(status().isOk());
+        MvcResult second = mockMvc.perform(get("/reset_password").param("code", code.getCode()))
+                .andExpect(status().isOk())
+                .andExpect(view().name("reset_password"))
+                .andReturn();
+
+        String formCode = (String) second.getModelAndView().getModel().get("code");
+        assertThat(codeStore.peekCode(formCode, IdentityZoneHolder.get().getId()).getExpiresAt()).isBeforeOrEqualTo(expiresAt);
+        mockMvc.perform(createChangePasswordRequest(user, formCode, true, "secret1", "secret1"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("/login?success=password_reset"));
+    }
+
+    @Test
+    void aRejectedPasswordDoesNotExtendTheCodeLifetime() throws Exception {
+        ScimUser user = getScimUser();
+        PasswordChange change = new PasswordChange(user.getId(), user.getUserName(), user.getPasswordLastModified(), "", "");
+        Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + 60_000);
+        ExpiringCode code = codeStore.generateCode(JsonUtils.writeValueAsString(change), expiresAt, FORGOT_PASSWORD_INTENT_PREFIX + user.getId(), IdentityZoneHolder.get().getId());
+
+        MvcResult result = mockMvc.perform(createChangePasswordRequest(user, code, true, "secret1", "different"))
+                .andExpect(status().isUnprocessableEntity())
+                .andReturn();
+
+        String renewedCode = (String) result.getRequest().getAttribute("code");
+        assertThat(codeStore.peekCode(renewedCode, IdentityZoneHolder.get().getId()).getExpiresAt()).isBeforeOrEqualTo(expiresAt);
+    }
+
     private MockHttpServletRequestBuilder createChangePasswordRequest(ScimUser user, ExpiringCode code, boolean useCSRF) throws Exception {
         return createChangePasswordRequest(user, code, useCSRF, "newpassw0rDl", "newpassw0rDl");
     }
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcZonePathTests.java
index 3a7c42c245f..873270541e4 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcZonePathTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcZonePathTests.java
@@ -1,6 +1,11 @@
 package org.cloudfoundry.identity.uaa.login;
 
 import org.cloudfoundry.identity.uaa.DefaultTestContext;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.test.util.AopTestUtils;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.cloudfoundry.identity.uaa.zone.IdentityZoneResolvingFilter;
+import org.cloudfoundry.identity.uaa.account.ResetPasswordController;
 import org.cloudfoundry.identity.uaa.account.UaaResetPasswordService;
 import org.cloudfoundry.identity.uaa.codestore.ExpiringCode;
 import org.cloudfoundry.identity.uaa.codestore.ExpiringCodeStore;
@@ -47,6 +52,8 @@
 import jakarta.servlet.http.Cookie;
 import java.sql.Timestamp;
 import java.util.Collection;
+import java.util.ArrayList;
+import java.util.Set;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
@@ -76,6 +83,8 @@ public class ResetPasswordControllerMockMvcZonePathTests {
     private ExpiringCodeStore codeStore;
     @Autowired
     private MockMvc mockMvc;
+    @Autowired
+    private FilterRegistrationBean<IdentityZoneResolvingFilter> identityZoneResolvingFilter;
 
     @BeforeEach
     void initResetPasswordTest() {
@@ -418,6 +427,42 @@ void resetPassword_ReturnsUnprocessableEntity_NewPasswordNotAccordingToPolicy()
         webApplicationContext.getBean(JdbcIdentityProviderProvisioning.class).update(uaaProvider, uaaProvider.getIdentityZoneId());
     }
 
+    @Test
+    void openingTheResetLinkTwiceStillWorksAndDoesNotExtendTheCodeLifetime() throws Exception {
+        ScimUser user = getScimUser();
+        PasswordChange change = new PasswordChange(user.getId(), user.getUserName(), user.getPasswordLastModified(), "", "");
+        Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + 60_000);
+        ExpiringCode code = codeStore.generateCode(JsonUtils.writeValueAsString(change), expiresAt, FORGOT_PASSWORD_INTENT_PREFIX + user.getId(), IdentityZoneHolder.get().getId());
+
+        mockMvc.perform(get("/reset_password").param("code", code.getCode()))
+                .andExpect(status().isOk());
+        MvcResult second = mockMvc.perform(get("/reset_password").param("code", code.getCode()))
+                .andExpect(status().isOk())
+                .andExpect(view().name("reset_password"))
+                .andReturn();
+
+        String formCode = (String) second.getModelAndView().getModel().get("code");
+        assertThat(codeStore.peekCode(formCode, IdentityZoneHolder.get().getId()).getExpiresAt()).isBeforeOrEqualTo(expiresAt);
+        mockMvc.perform(createChangePasswordRequest(user, formCode, true, "secret1", "secret1"))
+                .andExpect(status().isFound())
+                .andExpect(redirectedUrl("/login?success=password_reset"));
+    }
+
+    @Test
+    void aRejectedPasswordDoesNotExtendTheCodeLifetime() throws Exception {
+        ScimUser user = getScimUser();
+        PasswordChange change = new PasswordChange(user.getId(), user.getUserName(), user.getPasswordLastModified(), "", "");
+        Timestamp expiresAt = new Timestamp(System.currentTimeMillis() + 60_000);
+        ExpiringCode code = codeStore.generateCode(JsonUtils.writeValueAsString(change), expiresAt, FORGOT_PASSWORD_INTENT_PREFIX + user.getId(), IdentityZoneHolder.get().getId());
+
+        MvcResult result = mockMvc.perform(createChangePasswordRequest(user, code, true, "secret1", "different"))
+                .andExpect(status().isUnprocessableEntity())
+                .andReturn();
+
+        String renewedCode = (String) result.getRequest().getAttribute("code");
+        assertThat(codeStore.peekCode(renewedCode, IdentityZoneHolder.get().getId()).getExpiresAt()).isBeforeOrEqualTo(expiresAt);
+    }
+
     private MockHttpServletRequestBuilder createChangePasswordRequest(ScimUser user, ExpiringCode code, boolean useCSRF) throws Exception {
         return createChangePasswordRequest(user, code, useCSRF, "newpassw0rDl", "newpassw0rDl");
     }
@@ -447,6 +492,55 @@ private MockHttpServletRequestBuilder createChangePasswordRequest(ScimUser user,
         return post;
     }
 
+    @Test
+    void forgotPasswordForAnUnknownHostIsNotServedWhenRootDomainsAreConfigured() throws Exception {
+        Set<String> originalHostnames = identityZoneResolvingFilter.getFilter().getDefaultZoneHostnames();
+        identityZoneResolvingFilter.getFilter().restoreDefaultHostnames(Set.of("uaa.example.com"));
+        try {
+            mockMvc.perform(post("/forgot_password.do")
+                            .header("Host", "request-host.example.org")
+                            .param("username", "marissa"))
+                    .andExpect(status().isNotFound());
+        } finally {
+            identityZoneResolvingFilter.getFilter().restoreDefaultHostnames(originalHostnames);
+        }
+    }
+
+    @Test
+    void forgotPasswordLinkInZonePathRequestDoesNotUseTheRequestHostWhenLoginUrlIsBlank() throws Exception {
+        String subdomain = subdomainGenerator.generate();
+        ScimUser user = createUserInOtherZone(subdomain);
+        FakeJavaMailSender sender = webApplicationContext.getBean(FakeJavaMailSender.class);
+        sender.clearMessage();
+        Set<String> originalHostnames = identityZoneResolvingFilter.getFilter().getDefaultZoneHostnames();
+        identityZoneResolvingFilter.getFilter().restoreDefaultHostnames(Set.of("uaa.example.com"));
+        String originalLoginUrl = setLoginUrl("");
+        try {
+            mockMvc.perform(ZoneResolutionMode.ZONE_PATH.createRequestBuilder(subdomain, HttpMethod.POST, "/forgot_password.do")
+                    .header("Host", "request-host.example.org")
+                    .param("username", user.getUserName()));
+        } finally {
+            setLoginUrl(originalLoginUrl);
+            identityZoneResolvingFilter.getFilter().restoreDefaultHostnames(originalHostnames);
+        }
+        assertThat(contents(sender)).noneMatch(content -> content.contains("request-host.example.org"));
+    }
+
+    private String setLoginUrl(String loginUrl) {
+        ResetPasswordController controller = AopTestUtils.getUltimateTargetObject(webApplicationContext.getBean(ResetPasswordController.class));
+        String original = (String) ReflectionTestUtils.getField(controller, "externalLoginUrl");
+        ReflectionTestUtils.setField(controller, "externalLoginUrl", loginUrl);
+        return original;
+    }
+
+    private static List<String> contents(FakeJavaMailSender sender) throws Exception {
+        List<String> contents = new ArrayList<>();
+        for (FakeJavaMailSender.MimeMessageWrapper message : sender.getSentMessages()) {
+            contents.add(message.getContentString());
+        }
+        return contents;
+    }
+
     /**
      * Creates another identity zone (with admin client) and a user in that zone for zone-path tests.
      * Returns the created user; the zone is in the DB and request-based resolution will use it.
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointDocs.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointDocs.java
new file mode 100644
index 00000000000..56cb1fecee6
--- /dev/null
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointDocs.java
@@ -0,0 +1,60 @@
+package org.cloudfoundry.identity.uaa.mock.codestore;
+
+import org.cloudfoundry.identity.uaa.mock.EndpointDocs;
+import org.cloudfoundry.identity.uaa.mock.util.MockMvcUtils;
+import org.cloudfoundry.identity.uaa.zone.IdentityZoneSwitchingFilter;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.restdocs.snippet.Snippet;
+
+import static org.cloudfoundry.identity.uaa.test.SnippetUtils.fieldWithPath;
+import static org.cloudfoundry.identity.uaa.test.SnippetUtils.headerWithName;
+import static org.springframework.http.MediaType.APPLICATION_JSON;
+import static org.springframework.restdocs.headers.HeaderDocumentation.requestHeaders;
+import static org.springframework.restdocs.mockmvc.MockMvcRestDocumentation.document;
+import static org.springframework.restdocs.operation.preprocess.Preprocessors.preprocessResponse;
+import static org.springframework.restdocs.operation.preprocess.Preprocessors.prettyPrint;
+import static org.springframework.restdocs.payload.JsonFieldType.NUMBER;
+import static org.springframework.restdocs.payload.JsonFieldType.STRING;
+import static org.springframework.restdocs.payload.PayloadDocumentation.requestFields;
+import static org.springframework.restdocs.payload.PayloadDocumentation.responseFields;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+
+class CodeStoreEndpointDocs extends EndpointDocs {
+
+    private String loginToken;
+
+    @BeforeEach
+    void setUpToken() throws Exception {
+        loginToken = MockMvcUtils.getClientOAuthAccessToken(mockMvc, "login", "loginsecret", "oauth.login");
+    }
+
+    @Test
+    void document_create_code() throws Exception {
+        Snippet requestHeaders = requestHeaders(
+                headerWithName("Authorization").required().description("Bearer token with the scope `oauth.login` present, or a UAA admin token."),
+                headerWithName(IdentityZoneSwitchingFilter.HEADER).optional(null).description("If using a `zones.<zoneId>.admin` scope/token, indicates what zone this request goes to by supplying a zone_id."),
+                headerWithName(IdentityZoneSwitchingFilter.SUBDOMAIN_HEADER).optional(null).description("If using a `zones.<zoneId>.admin` scope/token, indicates what zone this request goes to by supplying a subdomain.")
+        );
+
+        Snippet requestFields = requestFields(
+                fieldWithPath("data").required().type(STRING).description("The data stored with the code, returned when the code is redeemed. For the flows below this is a JSON document written as a string."),
+                fieldWithPath("expiresAt").required().type(NUMBER).description("Expiry time of the code in milliseconds since the epoch. It must be in the future."),
+                fieldWithPath("intent").required().type(STRING).description("What the code may be used for. It is required and must not be blank. The values `EMAIL` (email change verification), `INVITATION` (invitation acceptance) and `REGISTRATION` (account activation) are used by the UAA flows of the same name; the match is case sensitive. Any other value is stored as given, for codes that your own application creates and redeems.")
+        );
+
+        Snippet responseFields = responseFields(
+                fieldWithPath("code").type(STRING).description("The generated one time code."),
+                fieldWithPath("expiresAt").type(NUMBER).description("Expiry time of the code in milliseconds since the epoch."),
+                fieldWithPath("data").type(STRING).description("The data stored with the code."),
+                fieldWithPath("intent").type(STRING).description("The intent stored with the code.")
+        );
+
+        mockMvc.perform(post("/Codes")
+                        .header("Authorization", "Bearer " + loginToken)
+                        .contentType(APPLICATION_JSON)
+                        .accept(APPLICATION_JSON)
+                        .content("{\"data\":\"{\\\"user_id\\\":\\\"a-user-id\\\"}\",\"expiresAt\":" + (System.currentTimeMillis() + 600_000) + ",\"intent\":\"MY_APPLICATION_CODE\"}"))
+                .andDo(document("{ClassName}/{methodName}", preprocessResponse(prettyPrint()), requestHeaders, requestFields, responseFields));
+    }
+}
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcTests.java
index 4a5dfc124d9..d59c95eacf7 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcTests.java
@@ -8,8 +8,8 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.NullSource;
 import org.junit.jupiter.params.provider.ValueSource;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
@@ -64,7 +64,7 @@ void tearDown() {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void generateCode(String url) throws Exception {
         Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
-        ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
 
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
@@ -81,11 +81,58 @@ void generateCode(String url) throws Exception {
 
     }
 
+    @ParameterizedTest
+    @ValueSource(strings = {"EMAIL", "INVITATION", "REGISTRATION", "email", "my-application-code"})
+    void generateCodeStoresGivenIntent(String intent) throws Exception {
+        Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", intent);
+
+        mockMvc.perform(post("/Codes")
+                        .header("Authorization", "Bearer " + loginToken)
+                        .contentType(APPLICATION_JSON)
+                        .accept(MediaType.APPLICATION_JSON)
+                        .content(JsonUtils.writeValueAsString(code)))
+                .andExpect(status().isCreated())
+                .andExpect(jsonPath("$.intent").value(intent));
+
+        assertThat(jdbcTemplate.queryForObject("select intent from expiring_code_store", String.class)).isEqualTo(intent);
+    }
+
+    @ParameterizedTest
+    @NullSource
+    @ValueSource(strings = {"", "  "})
+    void generateCodeWithoutIntent(String intent) throws Exception {
+        Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", intent);
+
+        mockMvc.perform(post("/Codes")
+                        .header("Authorization", "Bearer " + loginToken)
+                        .contentType(APPLICATION_JSON)
+                        .accept(MediaType.APPLICATION_JSON)
+                        .content(JsonUtils.writeValueAsString(code)))
+                .andExpect(status().isBadRequest());
+
+        assertThat(jdbcTemplate.queryForObject("select count(*) from expiring_code_store", Integer.class)).isZero();
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"/Codes", "/Codes/"})
+    void generateCodeWithNullBody(String url) throws Exception {
+        mockMvc.perform(post(url)
+                        .header("Authorization", "Bearer " + loginToken)
+                        .contentType(APPLICATION_JSON)
+                        .accept(MediaType.APPLICATION_JSON)
+                        .content("null"))
+                .andExpect(status().isBadRequest());
+
+        assertThat(jdbcTemplate.queryForObject("select count(*) from expiring_code_store", Integer.class)).isZero();
+    }
+
     @ParameterizedTest
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void generateCodeWithInvalidScope(String url) throws Exception {
         Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
-        ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
         String loginToken = testClient.getClientCredentialsOAuthAccessToken("admin", "adminsecret", "scim.read");
 
         String requestBody = JsonUtils.writeValueAsString(code);
@@ -103,7 +150,7 @@ void generateCodeWithInvalidScope(String url) throws Exception {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void generateCodeAnonymous(String url) throws Exception {
         Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
-        ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
 
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
@@ -119,7 +166,7 @@ void generateCodeAnonymous(String url) throws Exception {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void generateCodeWithNullData(String url) throws Exception {
         Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
-        ExpiringCode code = new ExpiringCode(null, ts, null, null);
+        ExpiringCode code = new ExpiringCode(null, ts, null, "EMAIL");
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -135,7 +182,7 @@ void generateCodeWithNullData(String url) throws Exception {
     @ParameterizedTest
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void generateCodeWithNullExpiresAt(String url) throws Exception {
-        ExpiringCode code = new ExpiringCode(null, null, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, null, "{}", "EMAIL");
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -152,7 +199,7 @@ void generateCodeWithNullExpiresAt(String url) throws Exception {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void generateCodeWithExpiresAtInThePast(String url) throws Exception {
         Timestamp ts = new Timestamp(System.currentTimeMillis() - 60000);
-        ExpiringCode code = new ExpiringCode(null, ts, null, null);
+        ExpiringCode code = new ExpiringCode(null, ts, null, "EMAIL");
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -169,7 +216,7 @@ void generateCodeWithExpiresAtInThePast(String url) throws Exception {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void retrieveCode(String url) throws Exception {
         Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
-        ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -200,7 +247,7 @@ void retrieveCode(String url) throws Exception {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void retrieveCodeThatIsExpired(String url) throws Exception {
         Timestamp ts = new Timestamp(Long.MAX_VALUE);
-        ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -227,7 +274,7 @@ void retrieveCodeThatIsExpired(String url) throws Exception {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void codeThatIsExpiredIsDeletedOnCreateOfNewCode(String url) throws Exception {
         Timestamp ts = new Timestamp(Long.MAX_VALUE);
-        ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -244,7 +291,7 @@ void codeThatIsExpiredIsDeletedOnCreateOfNewCode(String url) throws Exception {
         expireAllCodes();
 
         ts = new Timestamp(Long.MAX_VALUE);
-        code = new ExpiringCode(null, ts, "{}", null);
+        code = new ExpiringCode(null, ts, "{}", "EMAIL");
         requestBody = JsonUtils.writeValueAsString(code);
         post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -268,7 +315,7 @@ class WithCustomExpirationInterval {
         void setUp() throws Exception {
             // TODO: Why is this here?
             Timestamp ts = new Timestamp(Long.MAX_VALUE);
-            ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+            ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
             String requestBody = JsonUtils.writeValueAsString(code);
             MockHttpServletRequestBuilder post = post("/Codes")
                     .header("Authorization", "Bearer " + loginToken)
@@ -296,7 +343,7 @@ void tearDown() {
         void verifyExpirationIntervalWorks(String url) throws Exception {
             jdbcExpiringCodeStore.setExpirationInterval(10000000);
             Timestamp ts = new Timestamp(System.currentTimeMillis() + 1000);
-            ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+            ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
             String requestBody = JsonUtils.writeValueAsString(code);
             MockHttpServletRequestBuilder post = post(url)
                     .header("Authorization", "Bearer " + loginToken)
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcZonePathTests.java
index fa5197bc5f8..458b0a79f0f 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcZonePathTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/codestore/CodeStoreEndpointsMockMvcZonePathTests.java
@@ -12,9 +12,9 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Nested;
-import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.EnumSource;
+import org.junit.jupiter.params.provider.NullSource;
 import org.junit.jupiter.params.provider.ValueSource;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
@@ -77,7 +77,7 @@ void tearDown() {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void generateCode(String url) throws Exception {
         Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
-        ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
 
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
@@ -94,11 +94,58 @@ void generateCode(String url) throws Exception {
 
     }
 
+    @ParameterizedTest
+    @ValueSource(strings = {"EMAIL", "INVITATION", "REGISTRATION", "email", "my-application-code"})
+    void generateCodeStoresGivenIntent(String intent) throws Exception {
+        Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", intent);
+
+        mockMvc.perform(post("/Codes")
+                        .header("Authorization", "Bearer " + loginToken)
+                        .contentType(APPLICATION_JSON)
+                        .accept(MediaType.APPLICATION_JSON)
+                        .content(JsonUtils.writeValueAsString(code)))
+                .andExpect(status().isCreated())
+                .andExpect(jsonPath("$.intent").value(intent));
+
+        assertThat(jdbcTemplate.queryForObject("select intent from expiring_code_store", String.class)).isEqualTo(intent);
+    }
+
+    @ParameterizedTest
+    @NullSource
+    @ValueSource(strings = {"", "  "})
+    void generateCodeWithoutIntent(String intent) throws Exception {
+        Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", intent);
+
+        mockMvc.perform(post("/Codes")
+                        .header("Authorization", "Bearer " + loginToken)
+                        .contentType(APPLICATION_JSON)
+                        .accept(MediaType.APPLICATION_JSON)
+                        .content(JsonUtils.writeValueAsString(code)))
+                .andExpect(status().isBadRequest());
+
+        assertThat(jdbcTemplate.queryForObject("select count(*) from expiring_code_store", Integer.class)).isZero();
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"/Codes", "/Codes/"})
+    void generateCodeWithNullBody(String url) throws Exception {
+        mockMvc.perform(post(url)
+                        .header("Authorization", "Bearer " + loginToken)
+                        .contentType(APPLICATION_JSON)
+                        .accept(MediaType.APPLICATION_JSON)
+                        .content("null"))
+                .andExpect(status().isBadRequest());
+
+        assertThat(jdbcTemplate.queryForObject("select count(*) from expiring_code_store", Integer.class)).isZero();
+    }
+
     @ParameterizedTest
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void generateCodeWithInvalidScope(String url) throws Exception {
         Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
-        ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
         String loginToken = testClient.getClientCredentialsOAuthAccessToken("admin", "adminsecret", "scim.read");
 
         String requestBody = JsonUtils.writeValueAsString(code);
@@ -116,7 +163,7 @@ void generateCodeWithInvalidScope(String url) throws Exception {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void generateCodeAnonymous(String url) throws Exception {
         Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
-        ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
 
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
@@ -132,7 +179,7 @@ void generateCodeAnonymous(String url) throws Exception {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void generateCodeWithNullData(String url) throws Exception {
         Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
-        ExpiringCode code = new ExpiringCode(null, ts, null, null);
+        ExpiringCode code = new ExpiringCode(null, ts, null, "EMAIL");
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -148,7 +195,7 @@ void generateCodeWithNullData(String url) throws Exception {
     @ParameterizedTest
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void generateCodeWithNullExpiresAt(String url) throws Exception {
-        ExpiringCode code = new ExpiringCode(null, null, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, null, "{}", "EMAIL");
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -165,7 +212,7 @@ void generateCodeWithNullExpiresAt(String url) throws Exception {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void generateCodeWithExpiresAtInThePast(String url) throws Exception {
         Timestamp ts = new Timestamp(System.currentTimeMillis() - 60000);
-        ExpiringCode code = new ExpiringCode(null, ts, null, null);
+        ExpiringCode code = new ExpiringCode(null, ts, null, "EMAIL");
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -182,7 +229,7 @@ void generateCodeWithExpiresAtInThePast(String url) throws Exception {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void retrieveCode(String url) throws Exception {
         Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
-        ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -213,7 +260,7 @@ void retrieveCode(String url) throws Exception {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void retrieveCodeThatIsExpired(String url) throws Exception {
         Timestamp ts = new Timestamp(Long.MAX_VALUE);
-        ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -240,7 +287,7 @@ void retrieveCodeThatIsExpired(String url) throws Exception {
     @ValueSource(strings = {"/Codes", "/Codes/"})
     void codeThatIsExpiredIsDeletedOnCreateOfNewCode(String url) throws Exception {
         Timestamp ts = new Timestamp(Long.MAX_VALUE);
-        ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+        ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
         String requestBody = JsonUtils.writeValueAsString(code);
         MockHttpServletRequestBuilder post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -257,7 +304,7 @@ void codeThatIsExpiredIsDeletedOnCreateOfNewCode(String url) throws Exception {
         expireAllCodes();
 
         ts = new Timestamp(Long.MAX_VALUE);
-        code = new ExpiringCode(null, ts, "{}", null);
+        code = new ExpiringCode(null, ts, "{}", "EMAIL");
         requestBody = JsonUtils.writeValueAsString(code);
         post = post(url)
                 .header("Authorization", "Bearer " + loginToken)
@@ -294,7 +341,7 @@ class WithCustomExpirationInterval {
         void setUp() throws Exception {
             // TODO: Why is this here?
             Timestamp ts = new Timestamp(Long.MAX_VALUE);
-            ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+            ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
             String requestBody = JsonUtils.writeValueAsString(code);
             MockHttpServletRequestBuilder post = post("/Codes")
                     .header("Authorization", "Bearer " + loginToken)
@@ -322,7 +369,7 @@ void tearDown() {
         void verifyExpirationIntervalWorks(String url) throws Exception {
             jdbcExpiringCodeStore.setExpirationInterval(10000000);
             Timestamp ts = new Timestamp(System.currentTimeMillis() + 1000);
-            ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+            ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
             String requestBody = JsonUtils.writeValueAsString(code);
             MockHttpServletRequestBuilder post = post(url)
                     .header("Authorization", "Bearer " + loginToken)
@@ -351,7 +398,7 @@ void codes_endpoint_responds_for_zone_path(ZoneResolutionMode mode) throws Excep
             MockMvcUtils.createOtherIdentityZoneAndReturnResult(subdomain, mockMvc, webApplicationContext, loginClient, IdentityZoneHolder.getCurrentZoneId());
 
             Timestamp ts = new Timestamp(System.currentTimeMillis() + 60000);
-            ExpiringCode code = new ExpiringCode(null, ts, "{}", null);
+            ExpiringCode code = new ExpiringCode(null, ts, "{}", "EMAIL");
             String requestBody = JsonUtils.writeValueAsString(code);
 
             mockMvc.perform(mode.createRequestBuilder(subdomain, HttpMethod.POST, "/Codes")
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointMockMvcTests.java
index 8faba60ee7e..544b72f9f73 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointMockMvcTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointMockMvcTests.java
@@ -1,5 +1,9 @@
 package org.cloudfoundry.identity.uaa.scim.endpoints;
 
+import java.nio.charset.StandardCharsets;
+import org.springframework.web.util.UriComponents;
+import org.springframework.web.util.UriComponentsBuilder;
+import org.springframework.web.util.UriUtils;
 import tools.jackson.core.type.TypeReference;
 import org.cloudfoundry.identity.uaa.DefaultTestContext;
 import org.cloudfoundry.identity.uaa.codestore.ExpiringCode;
@@ -15,10 +19,12 @@
 import org.cloudfoundry.identity.uaa.util.JsonUtils;
 import org.cloudfoundry.identity.uaa.zone.IdentityZone;
 import org.cloudfoundry.identity.uaa.zone.IdentityZoneHolder;
+import org.cloudfoundry.identity.uaa.zone.MultitenantJdbcClientDetailsService;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.mock.web.MockHttpSession;
 import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.test.web.servlet.MvcResult;
 import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
@@ -30,6 +36,7 @@
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Set;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
@@ -164,41 +171,61 @@ void changePasswordWithClientidAndRedirecturi() throws Exception {
 
     @Test
     void changePasswordDoWithClientidAndRedirecturi() throws Exception {
-        String code = getExpiringCode(mockMvc, "app", "http://localhost:8080/app/", loginToken, scimUser);
-        String email = scimUser.getUserName();
-
-        MockHttpServletRequestBuilder get = get("/reset_password")
-                .param("code", code)
-                .param("email", email);
-
-        MvcResult result = mockMvc.perform(get)
-                .andExpect(status().isOk())
-                .andReturn();
-        assertThat(result.getResponse().getContentAsString())
-                .contains("<input type=\"hidden\" name=\"email\" value=\"%s\"/>".formatted(email));
-
-        String resultingCodeString = getCodeFromPage(result);
-
-        MockHttpServletRequestBuilder post = post("/reset_password.do")
-                .param("code", resultingCodeString)
-                .param("email", email)
-                .param("password", "newpass")
-                .param("password_confirmation", "newpass")
-                .with(cookieCsrf());
-
-        mockMvc.perform(post)
-                .andExpect(status().is3xxRedirection())
-                .andExpect(redirectedUrl(webApplicationContext.getServletContext().getContextPath() + "/login?success=password_reset&form_redirect_uri=http://localhost:8080/app/"));
-
-        post = post("/login.do")
-                .param("username", scimUser.getUserName())
-                .param("password", "newpass")
-                .param("form_redirect_uri", "http://localhost:8080/app/")
-                .with(cookieCsrf());
-
-        mockMvc.perform(post)
-                .andExpect(status().is3xxRedirection())
-                .andExpect(redirectedUrl("http://localhost:8080/app/"));
+        String clientId = "password-reset-" + generator.generate();
+        String redirectUri = "https://client.example.com/callback";
+        MultitenantJdbcClientDetailsService clientDetailsService =
+                webApplicationContext.getBean(MultitenantJdbcClientDetailsService.class);
+        clientDetailsService.addClientDetails(
+                MockMvcUtils.getClientDetailsModification(
+                        clientId,
+                        "secret",
+                        Collections.singleton("oauth"),
+                        Collections.singleton("uaa.none"),
+                        Collections.singleton("authorization_code"),
+                        "uaa.none",
+                        Set.of(redirectUri)),
+                IdentityZoneHolder.get().getId());
+        try {
+            String code = getExpiringCode(mockMvc, clientId, redirectUri, loginToken, scimUser);
+            String email = scimUser.getUserName();
+
+            MockHttpServletRequestBuilder get = get("/reset_password")
+                    .param("code", code)
+                    .param("email", email);
+
+            MvcResult result = mockMvc.perform(get)
+                    .andExpect(status().isOk())
+                    .andReturn();
+            assertThat(result.getResponse().getContentAsString())
+                    .contains("<input type=\"hidden\" name=\"email\" value=\"%s\"/>".formatted(email));
+
+            String resultingCodeString = getCodeFromPage(result);
+
+            MockHttpServletRequestBuilder post = post("/reset_password.do")
+                    .param("code", resultingCodeString)
+                    .param("email", email)
+                    .param("password", "newpass")
+                    .param("password_confirmation", "newpass")
+                    .with(cookieCsrf());
+
+            MvcResult resetResult = mockMvc.perform(post)
+                    .andExpect(status().is3xxRedirection())
+                    .andReturn();
+            assertRedirectsToLoginWithSingleFormRedirectUri(resetResult.getResponse().getRedirectedUrl(), redirectUri);
+
+            post = post("/login.do")
+                    .session((MockHttpSession) resetResult.getRequest().getSession())
+                    .param("username", scimUser.getUserName())
+                    .param("password", "newpass")
+                    .param("form_redirect_uri", redirectUri)
+                    .with(cookieCsrf());
+
+            mockMvc.perform(post)
+                    .andExpect(status().is3xxRedirection())
+                    .andExpect(redirectedUrl(redirectUri));
+        } finally {
+            clientDetailsService.removeClientDetails(clientId, IdentityZoneHolder.get().getId());
+        }
     }
 
     @Test
@@ -285,6 +312,15 @@ void zoneAdminCanResetsAndChangePassword() throws Exception {
                 .andExpect(jsonPath("$.code").isNotEmpty());
     }
 
+    private static void assertRedirectsToLoginWithSingleFormRedirectUri(String redirectedUrl, String expectedFormRedirectUri) {
+        UriComponents redirect = UriComponentsBuilder.fromUriString(redirectedUrl).build();
+        assertThat(redirect.getPath()).endsWith("/login");
+        assertThat(redirect.getFragment()).isNull();
+        assertThat(redirect.getQueryParams()).containsOnlyKeys("success", "form_redirect_uri");
+        assertThat(redirect.getQueryParams().getFirst("success")).isEqualTo("password_reset");
+        assertThat(UriUtils.decode(redirect.getQueryParams().getFirst("form_redirect_uri"), StandardCharsets.UTF_8)).isEqualTo(expectedFormRedirectUri);
+    }
+
     private static String getExpiringCode(MockMvc mockMvc, String clientId, String redirectUri, String loginToken, ScimUser scimUser) throws Exception {
         MockHttpServletRequestBuilder post = post("/password_resets")
                 .header("Authorization", "Bearer " + loginToken)
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcTests.java
index 360f54abcf6..2c4fa83f3b9 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcTests.java
@@ -537,7 +537,32 @@ void verification_link() throws Exception {
         assertThat(data.get(USER_ID)).isNotNull();
         assertThat(data)
                 .containsEntry(CLIENT_ID, clientDetails.getClientId())
-                .containsEntry(REDIRECT_URI, HTTP_REDIRECT_EXAMPLE_COM);
+                .containsEntry(REDIRECT_URI, HTTP_REDIRECT_EXAMPLE_COM)
+                .containsEntry("user_provisioned", "true");
+    }
+
+    @Test
+    void verification_link_opened_by_the_user_keeps_the_password_set_by_the_caller() throws Exception {
+        ScimUser joel = setUpScimUser();
+        MvcResult linkResult = mockMvc.perform(setUpVerificationLinkRequest(joel, scimCreateToken))
+                .andExpect(status().isOk())
+                .andReturn();
+        VerificationResponse verificationResponse = JsonUtils.readValue(linkResult.getResponse().getContentAsString(), VerificationResponse.class);
+        String code = getQueryStringParam(verificationResponse.getVerifyLink().getQuery(), "code");
+
+        MvcResult verifyResult = mockMvc.perform(get("/verify_user").param("code", code))
+                .andExpect(status().isFound())
+                .andReturn();
+
+        assertThat(verifyResult.getResponse().getRedirectedUrl()).startsWith("/login?success=verify_success");
+        ScimUser verified = usersRepository.retrieve(joel.getId(), IdentityZoneHolder.get().getId());
+        assertThat(verified.isVerified()).isTrue();
+        mockMvc.perform(post("/login.do")
+                        .with(cookieCsrf())
+                        .param("username", joel.getUserName())
+                        .param("password", USER_PASSWORD))
+                .andExpect(redirectedUrl("/"))
+                .andExpect(authenticated());
     }
 
     @Test
diff --git a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcZonePathTests.java b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcZonePathTests.java
index e558e2406b6..80746a648fb 100644
--- a/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcZonePathTests.java
+++ b/uaa/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcZonePathTests.java
@@ -281,7 +281,32 @@ void verification_link() throws Exception {
         assertThat(data.get(USER_ID)).isNotNull();
         assertThat(data)
                 .containsEntry(CLIENT_ID, clientDetails.getClientId())
-                .containsEntry(REDIRECT_URI, HTTP_REDIRECT_EXAMPLE_COM);
+                .containsEntry(REDIRECT_URI, HTTP_REDIRECT_EXAMPLE_COM)
+                .containsEntry("user_provisioned", "true");
+    }
+
+    @Test
+    void verification_link_opened_by_the_user_keeps_the_password_set_by_the_caller() throws Exception {
+        ScimUser joel = setUpScimUser();
+        MvcResult linkResult = mockMvc.perform(setUpVerificationLinkRequest(joel, scimCreateToken))
+                .andExpect(status().isOk())
+                .andReturn();
+        VerificationResponse verificationResponse = JsonUtils.readValue(linkResult.getResponse().getContentAsString(), VerificationResponse.class);
+        String code = getQueryStringParam(verificationResponse.getVerifyLink().getQuery(), "code");
+
+        MvcResult verifyResult = mockMvc.perform(get("/verify_user").param("code", code))
+                .andExpect(status().isFound())
+                .andReturn();
+
+        assertThat(verifyResult.getResponse().getRedirectedUrl()).startsWith("/login?success=verify_success");
+        ScimUser verified = usersRepository.retrieve(joel.getId(), IdentityZoneHolder.get().getId());
+        assertThat(verified.isVerified()).isTrue();
+        mockMvc.perform(post("/login.do")
+                        .with(cookieCsrf())
+                        .param("username", joel.getUserName())
+                        .param("password", USER_PASSWORD))
+                .andExpect(redirectedUrl("/"))
+                .andExpect(authenticated());
     }
 
     @Test