How long the brute force would take depends on a lot of factors. If done over the internet, it would depend on how fast the server responds to an attempt, and maybe whether the attacker is able to use multiple clients (i.e. a botnet) to run attempts in parallel. 8 characters is pretty short, but brute forcing it through the website would probably take a very long time.
Now if you were to get a hold of a hashed copy of the token (such as through a database compromise), it would be a lot faster, but would depend on the hashing algorithm. An 8-character password (upper + lower case) has about 52⁸, or 53 quadrillion possibilities.
As an example, according to this benchmark one GTX 1080 can calculate about 25 billion md5 hashes per second. This would calculate all possibilities in about 36 minutes.
According to the same benchmark, the same GPU would calculate a slow hash like bcrypt at about 13,000 hashes per second. That comes up to about 130 years. (Note, however, that the speed of bcrypt depends on the number of rounds it is configured to use. In the benchmark, the work factor appears to be set to 5.)
it never changes no matter howany times i ask for password reset link
it always comes with same token for that perticular account , wouldn't
you consider a vulnerability?
With regards to this, it would definitely be a bad practice. Reset tokens should be time limited. If the actual user requested the reset, he/she should be able to use the token within a short period of time. Allowing the reset token to be used indefinitely invites brute force attacks, and also gives more time for attackers to try to steal the token from the original user. Further, if the reset token never changes, it essentially becomes a permanent password-alternative that cannot be changed.