TYPO3 contains Insufficient Session Expiration after Password Reset

@@ -42,6 +42,7 @@
 use TYPO3\CMS\Core\PasswordPolicy\PasswordPolicyAction;
 use TYPO3\CMS\Core\PasswordPolicy\PasswordPolicyValidator;
 use TYPO3\CMS\Core\PasswordPolicy\Validator\Dto\ContextData;
+use TYPO3\CMS\Core\Session\SessionManager;
 use TYPO3\CMS\Core\SysLog\Action\Login as SystemLogLoginAction;
 use TYPO3\CMS\Core\SysLog\Error as SystemLogErrorClassification;
 use TYPO3\CMS\Core\SysLog\Type as SystemLogType;
@@ -340,6 +341,8 @@ public function resetPassword(ServerRequestInterface $request, Context $context)
             ->getConnectionForTable('be_users')
             ->update('be_users', ['password_reset_token' => '', 'password' => $this->getHasher()->getHashedPassword($newPassword)], ['uid' => $userId]);
 
+        $this->invalidateUserSessions($userId);
+
         $this->logger->info('Password reset successful for user {user_id)', ['user_id' => $userId]);
         $this->log(
             'Password reset successful for user %s',
@@ -493,4 +496,14 @@ protected function isValidPassword(string $password, array $user): bool
         $contextData = new ContextData(currentPasswordHash: $user['password']);
         return $passwordPolicyValidator->isValidPassword($password, $contextData);
     }
+
+    /**
+     * Invalidate all backend user sessions by given user id
+     */
+    protected function invalidateUserSessions(int $userId): void
+    {
+        $sessionManager = GeneralUtility::makeInstance(SessionManager::class);
+        $sessionBackend = $sessionManager->getSessionBackend('BE');
+        $sessionManager->invalidateAllSessionsByUserId($sessionBackend, $userId);
+    }
 }

@@ -22,6 +22,7 @@
 use TYPO3\CMS\Core\Context\Exception\AspectNotFoundException;
 use TYPO3\CMS\Core\Crypto\PasswordHashing\InvalidPasswordHashException;
 use TYPO3\CMS\Core\Crypto\PasswordHashing\PasswordHashFactory;
+use TYPO3\CMS\Core\Session\SessionManager;
 use TYPO3\CMS\Core\Type\ContextualFeedbackSeverity;
 use TYPO3\CMS\Core\Utility\GeneralUtility;
 use TYPO3\CMS\Extbase\Error\Error;
@@ -206,7 +207,9 @@ public function changePasswordAction(string $newPass, string $hash): ResponseInt
             return $hashedPassword;
         }
 
+        $user = $this->userRepository->findOneByForgotPasswordHash(GeneralUtility::hmac($hash));
         $this->userRepository->updatePasswordAndInvalidateHash(GeneralUtility::hmac($hash), $hashedPassword);
+        $this->invalidateUserSessions($user['uid']);
 
         $this->addFlashMessage($this->getTranslation('change_password_done_message'));
 
@@ -315,4 +318,14 @@ protected function exposeNoneExistentUser(?array $user): bool
             true
         );
     }
+
+    /**
+     * Invalidate all frontend user sessions by given user id
+     */
+    protected function invalidateUserSessions(int $userId): void
+    {
+        $sessionManager = GeneralUtility::makeInstance(SessionManager::class);
+        $sessionBackend = $sessionManager->getSessionBackend('FE');
+        $sessionManager->invalidateAllSessionsByUserId($sessionBackend, $userId);
+    }
 }