Hi @james.boswell,
Maybe you could consider redirecting twice. Once to a page where you inform the user about the expired passwords, and then a second time to the password change URL.
You would need to send the user back to the /continue
endpoint with the state
.
For example: https://{yourAuth0Domain}/continue?state=abc123
Thanks,
Rueben