Thank you for contacting us, and I'm sorry for the issue you are experiencing. Due to the way your data is protected in mSecure, there is no way to get a your data without knowing the account password. While the QR code is needed for a couple of reasons, one of which is to authenticate you as the owner of your account, the data stored in the code is encrypted with your account password. So without that password, the data in the QR code is of no use.
Do you still have access to your old phone by chance? If so, are you able to open mSecure on that device using Face ID? There will be no problems if you can access your data on at least one device.
The encryption security works doesn't allow you do what you're wanting to do here. If the password were able to changed when you're not signed in to your account, the data stored in mSecure would not be secure. In that case, we would have to have information to get in to your account, which means that data could be hacked, and then the system would have all sorts of security holes. Because of that, we don't have the information needed to get access to your account. The only way to get into it is by knowing the password, and if that password is forgotten, then the data cannot be decrypted.
Unfortunately, in these types of situations, if the password can't be remembered, there is no way to access the data stored in an mSecure account. One more thing to mention, you cannot use the Face ID captures from one device to unlock apps like mSecure on a new device. When you set up the new device, new face captures have to be added to the device. When that is done, all security information for mSecure, and other security apps, is negated in your iCloud account. It's like this on purpose to keep your information safe. If it wasn't, their would be security risks. In short, the password for your account must be known, and that password can't be reset if it has been forgotten without also deleing the information stored in the mSecure account.