AIKIDO-2026-996543

TL;DR

The FAB provider's Admin user-edit PATCH endpoint lets an administrator change another user's password without invalidating that user's existing active sessions. A user whose password was changed this way keeps using their prior session token as if nothing happened. This lets a compromised or rotated account remain reachable through a session that a password change was meant to kill. The fix invalidates existing sessions when an admin changes a user's password through this endpoint.