The vulnerabilities they found allow bypassing the two factor auth so works with only part of the credentials