Attackers can steal a user's cookie and gain access to the user's account without having to enter an ID and password or other form of authentication.