I wonder whether the password change mechanism asked for the old password... or if the same flaw existed.

"What's your old password?"

"something_more_than_8_characters_long"

"Let me check. The result of the check is... ERROR. Great, what's your new password?"