If it is TOTP/HOTP based rather than U2F (6-digit codes), it is vulnerable to real-time spoofing.