diff --git a/phpBB/admin/admin_users.php b/phpBB/admin/admin_users.php
index 6e5c1ce424..4c3a90bc36 100644
--- a/phpBB/admin/admin_users.php
+++ b/phpBB/admin/admin_users.php
@@ -696,6 +696,13 @@ if ( $mode == 'edit' || $mode == 'save' && ( isset($HTTP_POST_VARS['username'])
 						message_die(GENERAL_ERROR, 'Error removing user session', '', __LINE__, __FILE__, $sql);
 					}
 				}
+
+				// We remove all stored login keys since the password has been updated
+				// and change the current one (if applicable)
+				if ( !empty($passwd_sql) )
+				{
+					session_reset_keys($user_id, $user_ip);
+				}
 				
 				$message .= $lang['Admin_user_updated'];
 			}
diff --git a/phpBB/includes/sessions.php b/phpBB/includes/sessions.php
index ee4d42d31a..af6adc1cab 100644
--- a/phpBB/includes/sessions.php
+++ b/phpBB/includes/sessions.php
@@ -496,6 +496,59 @@ function session_clean($session_id)
 	return true;
 }
 
+/**
+* Reset all login keys for the specified user
+* Called on password changes
+*/
+function session_reset_keys($user_id, $user_ip)
+{
+	global $db, $userdata;
+
+	$key_sql = ($user_id == $userdata['user_id'] && !empty($userdata['session_key'])) ? "AND key_id != '" . md5($userdata['session_key']) . "'" : '';
+
+	$sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . '
+		WHERE user_id = ' . (int) $user_id . "
+			$key_sql";
+	$db->sql_query($sql);
+
+	if ( !$db->sql_query($sql) )
+	{
+		message_die(CRITICAL_ERROR, 'Error removing auto-login keys', '', __LINE__, __FILE__, $sql);
+	}
+
+	if ( !empty($key_sql) )
+	{
+		list($sec, $usec) = explode(' ', microtime());
+		mt_srand(hexdec(substr($userdata['session_id'], 0, 8)) + (float) $sec + ((float) $usec * 1000000));
+		$auto_login_key = uniqid(mt_rand(), true);
+
+		$current_time = time();
+		
+		$sql = 'UPDATE ' . SESSIONS_KEYS_TABLE . "
+			SET last_ip = '$user_ip', key_id = '" . md5($auto_login_key) . "', last_login = $current_time
+			WHERE key_id = '" . md5($userdata['session_key']) . "'";
+		
+		if ( !$db->sql_query($sql) )
+		{
+			message_die(CRITICAL_ERROR, 'Error updating session key', '', __LINE__, __FILE__, $sql);
+		}
+
+		// And now rebuild the cookie
+		$sessiondata['userid'] = $user_id;
+		$sessiondata['autologinid'] = $autologin_id;
+		$cookiename = $board_config['cookie_name'];
+		$cookiepath = $board_config['cookie_path'];
+		$cookiedomain = $board_config['cookie_domain'];
+		$cookiesecure = $board_config['cookie_secure'];
+
+		setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
+		
+		$userdata['session_key'] = $auto_login_key;
+		unset($sessiondata);
+		unset($auto_login_key);
+	}
+}
+
 //
 // Append $SID to a url. Borrowed from phplib and modified. This is an
 // extra routine utilised by the session code above and acts as a wrapper
diff --git a/phpBB/includes/usercp_register.php b/phpBB/includes/usercp_register.php
index 591af76ad3..2afcde17bb 100644
--- a/phpBB/includes/usercp_register.php
+++ b/phpBB/includes/usercp_register.php
@@ -527,6 +527,13 @@ if ( isset($HTTP_POST_VARS['submit']) )
 				message_die(GENERAL_ERROR, 'Could not update users table', '', __LINE__, __FILE__, $sql);
 			}
 
+			// We remove all stored login keys since the password has been updated
+			// and change the current one (if applicable)
+			if ( !empty($passwd_sql) )
+			{
+				session_reset_keys($user_id, $user_ip);
+			}
+
 			if ( !$user_active )
 			{
 				//