Weblate versions prior to 5.17.1 do not revoke Django REST Framework API tokens when a user changes their password. While browser sessions are invalidated correctly, API tokens with the 'wlu_*' prefix remain valid, potentially allowing continued API access after a password change. This issue is fixed in version 5.17.1.