OTP used in concurrent session, Logging in different browsers and at the same time entered same OTP and it is accepted by application. By not "burning" a previously used TOTP, devise-two-factor allows a narrow window of opportunity (aka the timestep period) where an attacker can re-use a verification code.