AIKIDO-2025-10667

TL;DR

Affected versions of this package are vulnerable to Insufficient Session Expiration on password update, where the implemented feature did not automatically revoke existing sessions and enforce re-authentication after a password change, allowing an attacker with a previously compromised session to maintain unauthorized access to the user's account and perform malicious actions until the session expires or is manually terminated.