diff --git a/core/Controller/LostController.php b/core/Controller/LostController.php
index d2d406ae8eec4..f41968a4bd322 100644
--- a/core/Controller/LostController.php
+++ b/core/Controller/LostController.php
@@ -122,7 +122,7 @@ public function resetform(string $token, string $userId): TemplateResponse {
 	protected function checkPasswordResetToken(string $token, string $userId): void {
 		try {
 			$user = $this->userManager->get($userId);
-			$this->verificationToken->check($token, $user, 'lostpassword', $user ? $user->getEMailAddress() : '', true);
+			$this->verificationToken->check($token, $user, 'lostpassword', $user?->getEMailAddress() ?? '', true);
 		} catch (InvalidTokenException $e) {
 			$this->logger->warning('Password reset token check failed', [
 				'user' => $userId,
diff --git a/lib/private/Security/VerificationToken/VerificationToken.php b/lib/private/Security/VerificationToken/VerificationToken.php
index 15007fa62adae..a2caac9538453 100644
--- a/lib/private/Security/VerificationToken/VerificationToken.php
+++ b/lib/private/Security/VerificationToken/VerificationToken.php
@@ -71,14 +71,14 @@ public function check(
 			$this->throwInvalidTokenException(InvalidTokenException::TOKEN_INVALID_FORMAT);
 		}
 
+		if (!hash_equals($splitToken[1], $token)) {
+			$this->throwInvalidTokenException(InvalidTokenException::TOKEN_MISMATCH);
+		}
+
 		if ($splitToken[0] < ($this->timeFactory->getTime() - self::TOKEN_LIFETIME)
 			|| ($expiresWithLogin && $this->lastInteractiveLogin->get($user) > $splitToken[0])) {
 			$this->throwInvalidTokenException(InvalidTokenException::TOKEN_EXPIRED);
 		}
-
-		if (!hash_equals($splitToken[1], $token)) {
-			$this->throwInvalidTokenException(InvalidTokenException::TOKEN_MISMATCH);
-		}
 	}
 
 	#[\Override]
diff --git a/tests/lib/Security/VerificationToken/VerificationTokenTest.php b/tests/lib/Security/VerificationToken/VerificationTokenTest.php
index ad0ea2d7e8a9c..df92e6522e48b 100644
--- a/tests/lib/Security/VerificationToken/VerificationTokenTest.php
+++ b/tests/lib/Security/VerificationToken/VerificationTokenTest.php
@@ -171,7 +171,7 @@ public function testTokenExpired(): void {
 
 		$this->crypto->method('decrypt')
 			->with('encryptedToken', 'foobar' . '357111317')
-			->willReturn('604800:mY70K3n');
+			->willReturn('604800:barfoo');
 
 		$this->timeFactory->expects($this->any())
 			->method('getTime')
@@ -179,7 +179,7 @@ public function testTokenExpired(): void {
 
 		$this->expectException(InvalidTokenException::class);
 		$this->expectExceptionCode(InvalidTokenException::TOKEN_EXPIRED);
-		$this->token->check('encryptedToken', $user, 'fingerprintToken', 'foobar');
+		$this->token->check('barfoo', $user, 'fingerprintToken', 'foobar');
 	}
 
 	public function testTokenExpiredByLogin(): void {
@@ -203,7 +203,7 @@ public function testTokenExpiredByLogin(): void {
 
 		$this->crypto->method('decrypt')
 			->with('encryptedToken', 'foobar' . '357111317')
-			->willReturn('604800:mY70K3n');
+			->willReturn('604800:barfoo');
 
 		$this->timeFactory->expects($this->any())
 			->method('getTime')
@@ -211,7 +211,7 @@ public function testTokenExpiredByLogin(): void {
 
 		$this->expectException(InvalidTokenException::class);
 		$this->expectExceptionCode(InvalidTokenException::TOKEN_EXPIRED);
-		$this->token->check('encryptedToken', $user, 'fingerprintToken', 'foobar', true);
+		$this->token->check('barfoo', $user, 'fingerprintToken', 'foobar', true);
 	}
 
 	public function testTokenNotExpiredBySessionRevalidation(): void {