Request a reset below (it just pretends to email a link). The real weakness is /reset/confirm: it accepts a reset token for a given account ref and, if it matches, logs you straight in as that account. If you already have the admin's reset token, you can confirm it directly:
Then GET /reset/confirm?ref=<admin ref>&token=<admin reset token>.