Description

The application NocoDB failed to invalidate the session after changing the password and In this scenario changing the password doesn’t destroy the other sessions which are logged in with old passwords.

Proof of Concept

Login same account in two different browsers.

Try to change the password from browser one.

You will see after changing the password, sessions don't get destroyed from another browser and it is still logged in with old passwords.

poc video

https://drive.google.com/file/d/1gFn8BLktl90v2YfIRTimvFgu2rhNWoTx/view?usp=sharing