This is stored in a cookie. Even with the cookie, you must be logged into Yahoo as the target account or know that password.

I think this is the same as if Yahoo became a native IdP.