IT Guy(@T3chFalcon):YES. password reset doesn't kill an active session by default. most platforms don't force logout on every device unless you explicitly hit "log out everywhere." so if an attacker's session cookie is still alive when you change your password, they're still in. password reset also doesn't touch: oauth grants — third-party apps you approved keep their tokens mail forwarding rules — silently BCC'ing every email you get delegate access — someone else added as a mailbox admin app-specific passwords — bypass your main login entirely mfa backup methods — a phone number or recovery email they added The fix is to revoke all sessions, audit connected apps, check forwarding rules, and review recovery methods.

2026.08.19 15:20

YES. password reset doesn't kill an active session by default. most platforms don't force logout on every device unless you explicitly hit "log out everywhere." so if an attacker's session cookie is still alive when you change your password, they're still in. password reset also doesn't touch: oauth grants — third-party apps you approved keep their tokens mail forwarding rules — silently BCC'ing every email you get delegate access — someone else added as a mailbox admin app-specific passwords — bypass your main login entirely mfa backup methods — a phone number or recovery email they added The fix is to revoke all sessions, audit connected apps, check forwarding rules, and review recovery methods.