security: me.py token-family blacklisting failures silently swallowed during password change

[farnalabs]

Problem

In me.py change_password (lines 260-271), when blacklist_family fails during password change, the exception is caught by the broad except Exception block at line 266, logged, and silently skipped. The loop continues to the next family and the password change commits. This means that if token-family blacklisting consistently fails (e.g., due to a database issue), the old refresh tokens could remain valid after a password change, allowing continued session hijacking.

Root Cause

Token-family blacklisting failures are silently swallowed instead of failing the password change operation.

Proposed Fix

Re-raise the exception after logging (or at minimum, fail the password change if any token family cannot be blacklisted). The current "fail-open" pattern is dangerous for session security.

Files

• backend/src/modulo/api/routes/me.py:260-271

Size

S (single file, small change)

Detector

LLM adversarial pass