How it was found

Hey, I've found a session management in help.nextcloud.com, which can lead to session takeover! Issue:

When the password of an account is changed from a session, other sessions doesn't expire!

Steps to Reproduce:

[+] We need to use two different browsers.

Login to both browsers!

1. Then change the password from one browser.
2. After changing the password, go to other browser, the session will still be alive
3. That means, server-side session not expire after password change.
4. This could be a risky factor for the user.

Thanks, Ahsan Tahir