An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.
CWE-639