App passwords could skip password confirmation on sensitive account endpoints

App passwords were accepted in place of the account password on some sensitive endpoints that normally require password confirmation. An attacker holding an app password could perform those sensitive actions without the main password.

Summary written from the sources below. Check the originals before acting.