The application does not invalidate existing authenticated sessions that used the "auto-login" checkbox after a user changes their password. As a result, other active sessions for the same account, including sessions on other browsers or devices, remain authenticated and usable after the password change is completed.

This can allow an attacker who has already obtained a valid session token or authenticated browser session to retain access even after the legitimate user changes their password. The issue weakens the effectiveness of password rotation as an account recovery measure and may allow continued unauthorized access to account data and user-level actions until the retained session expires or is manually revoked.