Direct answer
A password change can require different treatment of current and other sessions. Document the intended policy, verify the identity of the person making the change and test whether old credentials continue to work.
Prepare controlled sessions
Create a dedicated account with two browser sessions and a known recovery method. Record the policy for current-session continuity, other-device logout and notifications. Do not use a real user account or store its password in the report.
Reference: OWASP Authentication Cheat Sheet.
Change the password
Complete the supported change flow and check whether reauthentication is required for the sensitive action. Attempt a new login using the old password and then the new password. Check notification delivery only to the controlled inbox.
- Use unique test passwords and delete them after the exercise.
- Observe both browser sessions and any in-scope API session.
- Record the effective time of the change.
Evaluate existing sessions
Test the second browser's access to a harmless protected page and compare with policy. If a sign-out-everywhere option exists, test it separately. Federated sessions and short-lived access tokens may have different behavior and propagation times.
Retest and recover
After an improvement, repeat the change and session checks. Confirm the owner can still recover access through approved methods and that alerts do not reveal passwords or sensitive account data.
Assessment limits
Expected session behavior depends on the application's policy and identity provider. A single password change does not prove termination across every device and token type.
Frequently asked questions
Must all sessions always end after a password change?
The documented risk-based policy determines the intended behavior. Test that behavior and report any remaining access window.
Why check the old password afterward?
It confirms that future authentication uses the new credential; existing-session validity is a separate question.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.