Pen test M3: changing a password doesn't end the person's other sessions

From the penetration test report received on Friday, 23 October (Confluence SEC › Penetration test 2026): no critical or high findings, three medium, four low. This is M3, medium.

After a password change, a session elsewhere (a stolen laptop, a shared depot PC) keeps working until it ends on its own. End every other session of the person when their password changes, and when an administrator resets it. Due 20 November.