The triager categorized it

Broken Authentication and Session Management > Failure to Invalidate Session > On Password Reset and/or Change