Session Hijacking
Stealing a valid session identifier — through interception, XSS, or an insecure cookie — to act as the victim without ever knowing their password.
Session hijacking targets the token that proves a login already happened, not the login itself — which is why HttpOnly, Secure, and SameSite cookie attributes, rotating the session ID after login, and encoding output against XSS all matter as much as password strength ever did.