The password-change flow did not require the current password, so an attacker with a hijacked session could take over the account. Part of a four-issue account-takeover chain.
Authenticated password change does not verify the current password (account takeover).
cve.org record · GitHub Security Advisory GHSA-73f2-p9jr-m44x