You may as well give them an 'fix this or else I go public' with a reasonable deadline then. That's in everybody's interest.
This is probably very different from jurisdiction to jurisdiction, here in NL we have a government watchdog for such cases which starting 1/1/2016 will have a lot more teeth but in other countries the situation will surely be very different.
Anonymity would seem to be an asset in such cases.
Blackmail is one of those rare crimes that consist entirely of legal conduct.
But other than that, there is nothing preventing you from revealing the vulnerability, or worse, selling it on the grey market. The US government is a heavy buyer of vulnerabilities (although usually in applications, not in airline websites).