CP user password change retains sessions

[925dk]

Bug description

If you change your CP user password, then existing already signed in sessions will continue to function.

I would expect existing sessions to be invalidated immediately on password change (or maybe alternatively as a separate option for the user to do so).

As-is there seems no way for a CP user to re-secure their account if pw gets compromised.

How to reproduce

Login in two places. Change pw in one of them. Check back with the other.

Logs

No response

Environment

Environment
Application Name: xxx
Laravel Version: 11.18.1
PHP Version: 8.2.18
Composer Version: 2.5.8
Environment: production
Debug Mode: OFF
URL: xxx
Maintenance Mode: OFF
Timezone: UTC
Locale: en

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: CACHED

Drivers
Broadcasting: null
Cache: file
Database: sqlite
Logs: stack / single
Mail: sendmail
Queue: sync
Session: file

Statamic
Addons: 0
Sites: 2 (xxx (en), xxx (da))
Stache Watcher: Enabled
Static Caching: Disabled
Version: 5.17.1 PRO

Installation

Fresh statamic/statamic site via CLI

Additional details

No response