The easiest way is to perform both the task in question and the authentication in one go. Let the user fill out any forms and enter the password at the same page. When the user submit, you check that both the JWT and the password are correct server side, and if so execute the task.
This works well for tasks that don't require a lot of user input, like changing your email. For something bigger, like giving access to a full admin area, you need something else.
Lets look at the admin area as an example. One solution is to have a separate login endpoint for the admin area, and after authenticating the user at that endpoint you just add a flag to the JWT payload, e.g.
isLoggedInAsAdmin: true. If you want to have the logg in for the admin area expire quicker than the regular logg in you can just use a separate JWT instead.