diff -rN -u old-smederee/modules/hub/src/test/scala/de/smederee/hub/ResetPasswordRoutesTest.scala new-smederee/modules/hub/src/test/scala/de/smederee/hub/ResetPasswordRoutesTest.scala
--- old-smederee/modules/hub/src/test/scala/de/smederee/hub/ResetPasswordRoutesTest.scala	2025-01-13 01:52:04.821008550 +0000
+++ new-smederee/modules/hub/src/test/scala/de/smederee/hub/ResetPasswordRoutesTest.scala	2025-01-13 01:52:04.821008550 +0000
@@ -17,17 +17,11 @@
 
 package de.smederee.hub
 
-import java.nio.charset.StandardCharsets
-
 import cats.effect.*
 import cats.syntax.all.*
 import com.typesafe.config.ConfigFactory
 import de.smederee.hub.Generators.*
 import de.smederee.hub.config.*
-import de.smederee.hub.forms.*
-import de.smederee.hub.forms.types.*
-import de.smederee.security.SignAndValidate
-import de.smederee.security.SignedToken
 import org.http4s.*
 import org.http4s.implicits.*
 import org.http4s.server.*
@@ -44,7 +38,7 @@
             .at(SmedereeHubConfig.location)
             .loadOrThrow[SmedereeHubConfig]
 
-    test("GET forgot-password/change-password/TOKEN must show the change password form") {
+    test("GET forgot-password/change-password/TOKEN must return 200 and the change password form") {
         genValidAccount.sample match {
             case Some(account) =>
                 val token             = ResetToken.generate
@@ -84,5 +78,44 @@
                 }
             case _ => fail("Could not generate data samples!")
         }
+    }
+
+    test("GET forgot-password/change-password/TOKEN must return 404 for non existing token") {
+        genValidAccount.sample match {
+            case Some(account) =>
+                val token             = ResetToken.generate
+                val changePasswordUri = resetChangePasswordPath.addSegment(token.toString)
+
+                val authenticationConfig = configuration.service.authentication
+                val authenticationRepo   = new TestAuthenticationRepository[IO](List.empty, List.empty)
+                val emailMiddleware      = new TestEmailMiddleware[IO]
+                val externalConfig       = configuration.service.external
+                val resetPasswordRepo    = new TestResetPasswordRepository[IO](account, None)
+
+                def service: HttpRoutes[IO] =
+                    Router(
+                        "/" -> new ResetPasswordRoutes[IO](
+                            authenticationConfig,
+                            authenticationRepo,
+                            emailMiddleware,
+                            externalConfig,
+                            resetPasswordRepo
+                        ).routes
+                    )
+
+                def request                    = Request[IO](method = Method.GET, uri = changePasswordUri)
+                def response: IO[Response[IO]] = service.orNotFound.run(request)
+
+                val test = for {
+                    result <- response
+                    body   <- result.as[String]
+                } yield (result, body)
+
+                test.map { output =>
+                    val (result, _) = output
+                    assertEquals(result.status, Status.NotFound)
+                }
+            case _ => fail("Could not generate data samples!")
+        }
     }
 }