How session cookies work
After you log in, the server creates a session record and sends you a session cookie containing a random token. Every subsequent request includes this cookie — the server looks up the token to identify you.
Steal the cookie = impersonate the user. No password needed.