User's can't change passwords

I have a user who forgot his password.
He clicked on reset, got the email, clicked on the link, typed in the new password, and clicked submit. It goes to the homepage without an error, but the password isn’t reset, and the user can no longer login.

I’ve double checked the behavior with my admin user, and I can duplicate it.

truncating the login-security-fail table doesn’t help. deleting the configuration items that match %login-security% doesn’t help. I see in the wp_users table there is an activation key set for the users that have reset their password. I tried setting those to null as well, but no change. The user cannot login with the old or new password until the login-security-solution directory is removed, and then everything is fine.

https://wordpress.org/plugins/login-security-solution/