What are the security implications of an web application that allows users to change their passwords with the current (exactly the same) password?
I don't believe there are risks involved depending on the implementation. In the comments you pointed out the case is that a breach has occurred and the user was notified to change their password. In this specific case, depending on the complexity and length of the password in combination with the hash (and salt/pepper), the password might be cracked and a malicious user could login using the new same credentials which is a severe risk.
As I pointed out, it depends on the implementation. For example, if you use a one time password (like Wordpress) and an user can change the password to the same password, a malicious user might get access to the email account at some point in the future and find the one time password. Because the user now uses the same password permanently, a malicious user can now login.
To be fair, this is low risk and depending on the account, the implications could also be low so there is no real risk unless the password was leaked like you said in your comments.
Some password policies require changing the password every three months or so. By allowing the same password, or switching back and forth, this requirement can be bypassed. Whenever the password is expired, just change it to the same password and the password is valid for another three months.
However, requiring periodic password changes is no longer advised. It doesn't increase security and in some cases decreases security, when passwords like "summer2018" are used. Therefore, I would not regard the bypass of the periodic change policy a problem.