Session Doesn't expire after 2fa and also other session can change passsword

How it was found

Summary:

Hi team, I found one issue related to your 2FA system on https://sidefx.com

Steps To Reproduce:

Login to the Same account in 2 different browser Now on 1st browser go to https://sidefx.com/profile and complete the all steps of 2fa and Enable it | 2FA activated Now go to another session or 2nd browser and reload the page. The account doesn't logout session is still alive. and now change the password on 2nd browser (which doesn't have 2fa enabled) BOOM!

Impact

In this scenario when 2FA is activated the other sessions of the account are not invalidated. 2FA is required to login. I believe the expected and recommended behavior here is to terminate the other sessions> request a new login> request the 2FA code> so then give the account access again