CWE-1466 Improper Session Invalidation after Authentication Credential Change

The product provides a capability for users to change their authentication credentials, such as username or password, but it does not properly invalidate any current authenticated sessions after this authentication credential change.

• Authentication: Gain Privileges or Assume Identity — When a user changes their credentials, such as a password, they expect that the old password can no longer be used. If an adversary had previously logged in with a password that was compromised, they establish a session that was authenticated with that password and it must be invalidated on password change to prevent future compromise of the account.

• [Implementation] Ensure that user sessions are invalidated on the server-side after a change to their authentication credentials. It is important that the server-side handles all session invalidation and does not rely on the client to remove or delete a session due to the possibility of adversaries capturing session identifiers or cookies for later reuse.

• Dynamic Analysis with Manual Results Interpretation: Ensure that application testing includes scenarios where user authentication credentials are changed and verify that the previously authenticated sessions can no longer be used.

• CVE-2022-21652: session not invalidated on password change • CVE-2025-24859: session not invalidated on password change