Session is invalidated on password change

When a user changes their password they are often responding to a suspected compromise. Failing to invalidate existing sessions at that moment means an attacker who already has a session token retains access even after the user takes corrective action. CWE-613 and CWE-287 both cover this failure mode, and OWASP ASVS V3.3.1 requires that sessions be terminated on credential change. OWASP A07 lists this as an authentication lifecycle gap. In short: a password change that does not invalidate sessions is not a password change — it is a password addition.

Combine the password update and session revocation in a single atomic transaction so neither can succeed without the other:

// src/app/api/account/password/route.ts
async function changePassword(userId: string, newPassword: string) {
  const hash = await bcrypt.hash(newPassword, 12)
  await db.$transaction([
    db.user.update({ where: { id: userId }, data: { passwordHash: hash } }),
    db.session.deleteMany({ where: { userId } })
  ])
}

For JWT-only systems, store a passwordChangedAt timestamp on the user record and add a check in token validation that rejects any JWT with iat < passwordChangedAt.