Lack of Session Invalidation After Password Change

The application fails to invalidate existing active sessions upon a password change event. When a user changes their password in one session, other concurrent sessions (on different browsers or devices) remain active. This violates secure session management best practices (OWASP) and prevents a compromised user from effectively locking out an attacker. Steps to Reproduce: 1. Log in to Browser A. 2. Log in to Browser B. 3. Change password in Browser A. 4. Browser B session remains active. Expected Behavior: All other active sessions should be immediately terminated, forcing the user to re-authenticate with the new password.