It appears that it's possible for a malicious person to use the multiple OpenID logins feature to steal someone's account, if they have access to a logged-in session:
- Alice logs in to Stack Overflow with her normal OpenID account (Google, say).
- Alice steps away from her computer, leaving Stack Overflow logged in
- Eve wanders past and notices the open Stack Overflow session
- Eve goes to Alice's profile -> My logins
- Eve adds another login, one of her own OpenID accounts
- Eve then removes Alice's Google login and logs out
When Alice returns, she can no longer log in to her existing Stack Overflow account, since her only login method is no longer associated with it. Instead, Eve has full access to her account.
Is this considered a problem?