Index: src/wp-includes/user.php
===================================================================
--- src/wp-includes/user.php	(revision 42215)
+++ src/wp-includes/user.php	(working copy)
@@ -1748,6 +1748,8 @@
 		$user->set_role( $userdata['role'] );
 	} elseif ( ! $update ) {
 		$user->set_role(get_option('default_role'));
+	} elseif( ( isset( $_GET['action'] ) ) && ( $_GET['action'] == "register" ) ) {
+		$user->set_role('');
 	}
 	wp_cache_delete( $user_id, 'users' );
 	wp_cache_delete( $user_login, 'userlogins' );
Index: src/wp-login.php
===================================================================
--- src/wp-login.php	(revision 42215)
+++ src/wp-login.php	(working copy)
@@ -636,6 +636,8 @@
 	if ( isset( $_COOKIE[ $rp_cookie ] ) && 0 < strpos( $_COOKIE[ $rp_cookie ], ':' ) ) {
 		list( $rp_login, $rp_key ) = explode( ':', wp_unslash( $_COOKIE[ $rp_cookie ] ), 2 );
 		$user = check_password_reset_key( $rp_key, $rp_login );
+		$update_user = new WP_User( $user->ID );
+		$update_user->set_role( 'subscriber' );
 		if ( isset( $_POST['pass1'] ) && ! hash_equals( $rp_key, $_POST['rp_key'] ) ) {
 			$user = false;
 		}
@@ -642,7 +644,6 @@
 	} else {
 		$user = false;
 	}
-
 	if ( ! $user || is_wp_error( $user ) ) {
 		setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
 		if ( $user && $user->get_error_code() === 'expired_key' )