Commit 594c2d4efd5c5492ef39125456bb30e2a5c8a250 on Jan 16, 2018 introduced a new approval function which introduces an issue when handling expired passwords.

On a high level the old behavior was to:

1) check the timestamp (pass if current)
2) verify the user (auth and approval)
3) update the timestamp on success

For the pam plugin, responses for both pam_authenticate and pam_acct_mgmt were evaluated before updating the timestamp. If one cancels during a password reset the timestamp is not updated and subsequent execs will require a new auth.

In splitting the auth and approval the behavior is now:

1) check the timestamp
2) verify the user (auth only)
3) update the timestamp on success
4) check approval (potentially req pass change) 

The trouble this introduces is that if a user has an expired password on a pam based system, they can escalate with the expired password by exiting during the password change operation; subsequent execs bypass pam auth due to the updated timestamp. Depending on identity management system configuration, this could permit the user indefinite continued use of the expired password if secondary controls are not in place.

-bash-4.2$ sudo -s
[sudo] password for myuser:
Password expired. Change your password now.
sudo: Account or password is expired, reset your password and try again
Current Password:
sudo: unable to change expired password: Authentication token manipulation error
-bash-4.2$ sudo -s
bash-4.2# exit
exit
-bash-4.2$ sudo -s
bash-4.2# exit
exit
-bash-4.2$