A security researcher has detailed a way to log into any account on the same computer, even without knowing its password. The trick works on all Windows versions, doesn’t require special privileges, and the researcher can’t figure out if it’s a Windows feature or security flaw. The attack can be performed using physical access to the device, but also via an RDP session on a hacked machine, escalating the attacker s access to other (higher-privileged) accounts. Back in 2011, a security researcher for the Bank of France detailed the very same user session hijacking technique on his blog.
Source: https://www.bleepingcomputer.com/news/security/new-but-old-technique-hijacks-user-sessions-on-all-windows-versions/