Old Password Still Active???

[zmikko]

I recently updated my password only a few days ago; today when I went to login first thing in the morning I entered my old password out of habit, and it let me in! I tried it, and both passwords seem to be working at the moment. Also tried updating the password again, which didn't work? What's going on?

Sugar Community Edition

[kuske]

Do you perhaps use LDAP authentification on your system?

If you use LDAP authentification you can login with your LDAP user/pw and your Sugar user/pw which you can set by a change password call.

Sugar always checks first the LDAP user/pw, and if not successful the Sugar user/pw. This allows mixed authentification - LDAP for employees and Sugar for contractors, but it is a security issue too.
It should be disallowed to LDAP users to change their password, as they cannot change it in LDAP.