diff --git a/api_views/users.py b/api_views/users.py
index 172540a..fdf00db 100644
--- a/api_views/users.py
+++ b/api_views/users.py
@@ -183,17 +183,9 @@ def update_password(username):
         return Response(error_message_helper(resp), 401, mimetype="application/json")
     else:
         if request_data.get('password'):
-            if vuln:  # Unauthorized update of password of another user
-                user = User.query.filter_by(username=username).first()
-                if user:
-                    user.password = request_data.get('password')
-                    db.session.commit()
-                else:
-                    return Response(error_message_helper("User Not Found"), 400, mimetype="application/json")
-            else:
-                user = User.query.filter_by(username=resp['sub']).first()
-                user.password = request_data.get('password')
-                db.session.commit()
+            user = User.query.filter_by(username=resp['sub']).first()
+            user.password = request_data.get('password')
+            db.session.commit()
             responseObject = {
                 'status': 'success',
                 'Password': 'Updated.'
diff --git a/tests/test_password_change.py b/tests/test_password_change.py
new file mode 100644
index 0000000..c7b3ee5
--- /dev/null
+++ b/tests/test_password_change.py
@@ -0,0 +1,8 @@
+from pathlib import Path
+
+
+def test_password_change_uses_authenticated_subject():
+    source = Path("api_views/users.py").read_text()
+    section = source[source.index("def update_password"):source.index("def delete_user")]
+    assert "User.query.filter_by(username=resp['sub'])" in section
+    assert "if vuln:  # Unauthorized update" not in section