Daptin's authentication system has a session invalidation vulnerability where JSON Web Tokens (JWTs) remain valid after a user changes their password. The JWT validation middleware does not verify if the token was issued before the most recent password change, allowing old tokens to retain full access. The password update process hashes the new password but does not revoke or blacklist existing tokens or invalidate the authentication cache. This flaw negates password rotation as an effective security control.