I'm trying to figure out how to issue a one-time use JWT token for password reset feature and still keeping it stateless. Came across Single-Use Tokens w/ JWT which basically suggests to include hash of current password which in turn gets invalidated once the password is changed successfully.
I don't feel comfortable including the password hash in JWT so I researched a bit and found JWT ID specification but that requires to store the ID somewhere so it can be checked on token validation.
So my question is, what are the security concerns if I include the current password hash in the password reset link token which is sent over email?
Is it better to use a JWT ID and add that as a column somewhere in the database instead of using the password?