I think it is OK not to terminate existing sessions if user is locked out due to a number of login attempts with the wrong password. Because it might be an attack and it would be inconvenient to terminate the existing session each time this happens.
But what about the password change process? Entering the old password wrong will increment the lockout counter but should I terminate the session when the treshold is exceeded? (Or if it is exceeded already?)
And I am not returning the locked out status in case of failed login attempts due to security concerns. Should I return this status to the user in case of password changing attempt?