All Active user sessions should be deleted when user change his password!

Summary

When a user changed his/her password (either directly or with reset password flow), existing sessions were kept active.

We already invalidate all sessions when a user logs out, but we were not doing the same for password changes. This means that if an attacker were to get access to an account, even if you changed your password, it would not directly disable his/her session (unless you explicitly went to "logout", which is not the most user-intuitive).

As a result of this report, we rethought how we handled password changes, and we decided to invalidate all sessions on a password change/reset to protect from this possible problem.

Existing user sessions wasn't getting destroyed when a HackerOne user changed his password from account panel or through password reset token! HackerOne was aware of this issue, but didn't consider it as an immediate fix as another fix (all active sessions invalidates when user logout from account) was in place. As a result of this report, HackerOne team decided to invalidate all sessions on a password change/reset to protect from this possible problem.

Thanks to HackerOne team for fixing this issue and the bounty!