Apple’s 2FA iCloud system is generally very diligent about securing your account, especially when you have two devices, but it has one key flaw.

Source: How Apple’s iCloud authentication system fails to protect your account when using a browser