Horizon supports changing a expired password as long as the account is not locked out.

Do you by chance use a MFA solution through RADIUS? We've seen where that will result in what you are seeing and it's a known limitation.