this is pretty bad
it took me about half a minute of thinking to think of where to execute a POST request with JS while signed into SE and deny any attacked user access to his account
I decided to change my password via the
my logins link, and was presented with this dialog:
Notice the lack of confirmation of current password.
I love that I can stay logged in to Stack Exchange sites permanently, but it worries me that someone could change my password without knowing my current password.
The confirmation email says:
The password to your Stack Exchange account has been changed.
(If you didn't do this, you should be worried.)
The link is to https://openid.stackexchange.com/user so would presumably need me to be logged in there (which I wasn't) to do anything about it.
P.S. This is related to but not duplicate of Logins can be added/removed without reauthenticating, allowing temporary XSS to be escalated to permanent account hijacking, with both bugs stemming from lack of defense-in-depth here.