From add042ef2f05828a8ea5f6d0a089204bae2322d5 Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Tue, 13 Oct 2026 02:52:58 -0400
Subject: [PATCH] fix: end other sessions when a user changes their password
 (#11710)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 ...db63d19f1c9ab0366e01c0092aa653ab51877.json | 15 ++++++++++++++
 backend/windmill-api/src/users.rs             | 20 +++++++++++++++++--
 2 files changed, 33 insertions(+), 2 deletions(-)
 create mode 100644 backend/.sqlx/query-c3c51c3536eaa6a5e702d306344db63d19f1c9ab0366e01c0092aa653ab51877.json

diff --git a/backend/.sqlx/query-c3c51c3536eaa6a5e702d306344db63d19f1c9ab0366e01c0092aa653ab51877.json b/backend/.sqlx/query-c3c51c3536eaa6a5e702d306344db63d19f1c9ab0366e01c0092aa653ab51877.json
new file mode 100644
index 0000000000..be4fbb73c9
--- /dev/null
+++ b/backend/.sqlx/query-c3c51c3536eaa6a5e702d306344db63d19f1c9ab0366e01c0092aa653ab51877.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM token WHERE email = $1 AND label = 'session' AND token_hash != $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "c3c51c3536eaa6a5e702d306344db63d19f1c9ab0366e01c0092aa653ab51877"
+}
diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs
index 39a213c860..5b26cf57b8 100644
--- a/backend/windmill-api/src/users.rs
+++ b/backend/windmill-api/src/users.rs
@@ -198,6 +198,7 @@ async fn set_password(
     Extension(db): Extension<DB>,
     Extension(argon2): Extension<Arc<Argon2<'_>>>,
     authed: ApiAuthed,
+    Tokened { token }: Tokened,
     OptJobAuthed { job_id, .. }: OptJobAuthed,
     Json(ep): Json<EditPassword>,
 ) -> Result<String> {
@@ -206,7 +207,15 @@ async fn set_password(
     // (GHSA-hfh4-cx4h-3fcr).
     forbid_elevated_job_token(&db, &authed.email, job_id).await?;
     let email = authed.email.clone();
-    crate::users_oss::set_password(db, argon2, authed, &email, ep).await
+    let res = crate::users_oss::set_password(db.clone(), argon2, authed, &email, ep).await?;
+    sqlx::query!(
+        "DELETE FROM token WHERE email = $1 AND label = 'session' AND token_hash != $2",
+        &email,
+        windmill_common::auth::hash_token(&token)
+    )
+    .execute(&db)
+    .await?;
+    Ok(res)
 }
 
 async fn set_password_of_user(
@@ -219,7 +228,14 @@ async fn set_password_of_user(
 ) -> Result<String> {
     require_super_admin(&db, &authed).await?;
     forbid_superadmin_job_token(&db, &authed.email, job_id).await?;
-    crate::users_oss::set_password(db, argon2, authed, &email, ep).await
+    let res = crate::users_oss::set_password(db.clone(), argon2, authed, &email, ep).await?;
+    sqlx::query!(
+        "DELETE FROM token WHERE email = $1 AND label = 'session'",
+        &email
+    )
+    .execute(&db)
+    .await?;
+    Ok(res)
 }
 
 #[derive(Deserialize)]