When you reset your CircleCI password, not all active sessions are automatically terminated. The behavior differs depending on how each session was created.
What gets invalidated
Resetting your password will invalidate sessions that were established using your email and password credentials. After a reset, anyone using those credentials will need to log in again with the new password.
What does not get invalidated
Sessions established via OAuth (for example, through GitHub or Bitbucket) are not automatically terminated when you reset your password. These sessions operate independently of your CircleCI password and will remain active until they expire or are explicitly revoked.
If you suspect unauthorized access
If you believe your account has been compromised, a password reset alone may not be sufficient to remove an attacker's access if they have an active OAuth session. We recommend taking the following steps:
Reset your CircleCI password immediately.
Revoke CircleCI's OAuth access from within your connected provider (GitHub or Bitbucket). This will terminate all OAuth-based sessions. See our article on resolving OAuth token revocation issues for guidance.
Review your active API tokens in your CircleCI user settings and rotate or delete any you do not recognize.
Check your organization's audit log for unexpected activity.
Contact [email protected] if you believe a breach has occurred or you need further assistance.
Additional resources
How do I report a security vulnerability?
What to do if you suspect you have a secret leaked from CircleCI
Does CircleCI Support Multi Factor Authentication?