Session Control does not work properly when race condition happens

Describe the bug
When login is performed by the same user multiple times from different internet browsers / devices, login can be performed successfully despite setting only 1 max session.

To Reproduce
Have the following code in the SecurityFilterChain

http.sessionManagement(sessionManagement -> {
      sessionManagement.maximumSessions(1);
    });

and when the race condition happens, the session count is 2 despite the above setting.

Expected behavior
Only the last login session should persist, all other sessions should be terminated.

Sample
I've done up a sample here.
Start the Spring Boot Application by the using the java class SecuringWebApplication.java
https://github.com/samueljz/spring-concurrency-issue/tree/main/complete

Race conditions can be introduced using tools such as Burp Suite.

Start with the sample application's SecuringWebApplication.java and its SecurityFilterChain, then reproduce concurrent logins with maximumSessions(1), using the reported race-condition setup if available. Trace the session-control behavior during simultaneous logins; done means only the last login session persists and the session count does not exceed one.