A problem which has made the news repeatedly is services where an e.g. password reset doesn't reset / invalidate the session key. How many cases of ridiculously

A problem which has made the news repeatedly is services where an e.g. password reset doesn't reset / invalidate the session key. How many cases of ridiculously short session expiry are masking cases where the service is unable to actually manage to invalidate a session key in conjunction with said password reset?