Session token replay

Reuse of a stolen authentication token or cookie from an attacker's machine to enter an account, sidestepping the password and any second factor because both were consumed when the token was issued.