The previous answers claim that from a security perspective it does not matter whether the user is being logged in automatically or not after the password-reset is completed but this really depends on how the token contained in the password-reset link is designed.
The token included in the password-reset link is necessarily comprised of two pieces of information:
- It needs to hold the information that it grants permission to reset the password.
- It needs to contain a reference or somehow be associated to the user account for which this permission is valid.
Now, how the second aspect, i.e. the "reference to the user account", is conveyed by the token actually makes a difference to whether it matters that a user is automatically logged in after password-reset or not.
Let's assume the attacker somehow intercepted the e-mail that contains the password-reset link.
If the token does not reveal any information about the associated user account, more precisely the username, and the system does not auto-login after password reset, then the attacker that has the link can only reset the password with this link but cannot gain further access to the system since the username is still not known to him/her. After resetting the password, the attacker is redirected to the login page where he/she has to enter the username which he cannot infer from just the link he/she stole – so the only damage being done here is the password being changed but no sensitive data was accessed.
In contrast, if the token contains a reference to the user account in form of a username that can be extracted by the attacker then indeed it does not matter if the system does an auto-login after password reset or not because then the attacker already knew the username (inferring it from the link) with which he/she can potentially login and gain access to the system sensitive data.