Description

On changing password both session using which user changes password and old sessions in any other browser or device does not expire and remains active.

Proof of Concept

STEPS TO REPRODUCE:

1. Log in to Browser A and make sure to check 'stay logged in to this device' checkbox while logging in.
2. From Browser B login to your account and change password Notice that Session on Browser Awill remain active and does not expire.

Impact

The session doesn't expire even after the victim changes the password. Due to this bug, there is no way for the victim to revoke access of attacker if account has been already compromised.