1
Verify the likely cause
Store a token version or session identifier, increment it on password reset and validate it on protected requests; use shorter access-token lifetimes.
FULL AI ANALYSIS
Account sessions remain valid after password reset
Generated Sep 24, 2026, 11:55:04 PM
Analysis summary
The reported behaviour is consistent with previously issued JWTs have no server-side revocation or credential-version check. The safest next step is to verify that hypothesis with a reversible test before making permanent configuration changes.
Possible causes
Previously issued JWTs have no server-side revocation or credential-version check.
84%A recent software, firmware or configuration change is exposing an existing compatibility issue.
36%Suggested fixes
2
Validate and monitor
Reproduce the issue once after the change, review relevant logs or metrics, and keep a rollback path until the system has remained stable.